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Opening Statement: Chairman Robert Aderholt 

Mr. Aderholt. The hearing will come to order. The hearing 
today is on the Department of Homeland Security’s Chemical Facil- 
ity Anti-Terrorism Standards Program, better known as CFATS. To 
better understand the difficulties that this program has experi- 
enced we welcome the NPPD Deputy Under Secretary Suzanne 
Spaulding, and Steven Caldwell from the Government Account- 
ability Office. I think the microphone is working now. 

Today, as we are all unfortunately aware, the Chemical Facility 
Anti-Terrorism Standards, which as I mentioned is commonly 
known as CFATS, has struggled. This was highlighted in a very 
disturbing internal report that was leaked to the media this past 
December concerning the management of the CFATS program. 

Since the program was created in fiscal year 2007, industry 
stakeholders have made many improvements at their sites and 
spent hundreds of millions of dollars complying with the CFATS 
policy. However, after five years it is clear that the Department of 
Homeland Security has absolutely failed to fully develop an effi- 
cient and effective program. 

The internal memo specifically notes that the lack of a well de- 
veloped direction and plan led to, and I quote this, “the hiring of 
inappropriate people; the expenditure of significant funds for what 
has since been determined to be unnecessary expenses and several 
false starts in the direction of the program.” The memo further con- 
cludes that these and other gaps, “now pose a risk to the program.” 

The Department of Homeland Security must address each of the 
issues that were brought to light in the memo and provide industry 
with the direction they need to move forward and the taxpayers 
with a viable program. Today we want to hear from the GAO on 

( 1 ) 
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the difficulties that are hindering the program, how they are ad- 
dressing these issues, and how the program is being restructured. 

In short we want to know what we would gain from nearly half 
a billion dollars appropriated for the CFATS program and how we 
are going to fix this broken program, a program that was intended 
to fill the vital mission of preventing hazardous chemicals from 
falling into the wrong hands. 

Let me make it clear up front to those with the Department of 
Homeland Security in attendance today: this subcommittee cannot 
tolerate waste, fraud, and abuse. Especially when we are dealing 
with vital security programs and our vital budget is hemorrhaging 
red ink. 

Lastly I want to express my concern with the lack of outreach 
that the NPPD has had toward this subcommittee. Last Friday the 
CFATS program withdrew the personal surety programs informa- 
tion collection requests from review at 0MB. Even though this 
committee, and other congressional committees of jurisdiction, has 
been very outspoken on this issue, the department failed to notify 
the committee or formally explain the reasons for the withdrawal. 
This lack of information sharing is unfortunate and counter- 
productive to effective oversight. Secretary Spaulding, could you 
commit today that this behavior will not continue? That you per- 
sonally will ensure that the NPPD will work with Congress so we 
can move forward in a positive manner, working together towards 
a common goal, toward fiscal responsibility and an effective pro- 
gram? 

Given the breadth of these topics, we will clearly have an inter- 
esting discussion today. We are unsure exactly what the vote 
schedule is going to be this morning but we are going to proceed 
under normal order. So Under Secretary Spaulding and Mr. 
Caldwell, if you could summarize your testimony for a few minutes, 
and then you can submit any kind of statement that you want for 
the record. That will also give us time for answers and questions. 

But before we begin I would like to recognize the ranking mem- 
ber of this subcommittee, Mr. Price, for his opening remarks. 

[The information follows:] 
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Today we will discuss the Department of Homeland Security’s Chemical Security Anti-Terrorism Standards 
(CFATS) program. To help us better understand the difficulties that this program has experienced, we welcome 
NPPD Deputy Under Secretary Suzanne Spaulding and Mr. Steven Caldwell from the Government 
Accountability Office. 

As we are all unfortunately aware, the Chemical Facility Anti-Terrorism Standards - commonly called, “CFATS” 
has struggled. This was highlighted in a very disturbing internal report was leaked to the media this past December 
concerning the management of the CFATS program. 

Since the program was created in fiscal year 2007, industry stakeholders have made many improvements at 
their sites and spent hundreds of millions of dollars complying with CFATS policies. However, after five years 
- it is clear DHS has absolutely failed to fully develop an efficient and effective program. 

The internal memo specifically notes that the lack of well-developed direction and plan led to. . .and I quote. . . 

“the hiring of inappropriate people, the expenditure of significant funds for what have since been determined to 
be unnecessary expenses and several false starts in the direction of the program.” The memo further concludes 
that these and other gaps “now pose a risk to the program.” 

DHS must address each of the issues that were brought to light in the memo - and provide industry the direction 
they need to move forward and the taxpayer with a viable program. Today, we want to hear from GAO on the 
difficulties that are hindering the program and from the Department on how they are addressing these issues and 
how the program is being restructured. 

In short, we want to know what we’ve gained from the nearly half a billions dollars appropriated for CFATS 
and how we are going to fix this broken program - a program intended to fulfill the vital mission of preventing 
hazardous chemicals from falling into the wrong hands. 

Let me make it very clear to those of you from DHS in attendance today - this Subcommittee will not tolerate 
waste, fraud, and abuse. . .especially when we are dealing with vital security programs and our federal budget is 
hemorrhaging red ink. 

Lastly, I also want to express my concern with the lack of outreach by NPPD to this the Committee. Last 
Friday, the CFATS program withdrew the Personnel Surety Program’s Information Collection Request from 
review at 0MB. Even though this Committee - and other Congressional Committees of jurisdiction - has been 
very outspoken on this issue, the Department failed to notify the Committee or formally explain the reasons for 
the withdrawal. This lack of information sharing is unfortunate and counterproductive to effective 
oversight. Secretary Spaulding, will you commit today that this behavior will not continue - that you 
personally will ensure that NPPD will work with Congress so we can all move forward in a positive manner - 
working together towards a common goal of fiscally responsible and effective programs? 

Given the breadth of these topics, we will clearly have an interesting discussion today. Under Secretary 
Spaulding and Mr. Caldwell, please summarize your written testimony in a brief statement so that we will have 
time for a direct exchange of questions and answers. Before you begin, however, I recognize Ranking Member 
Price, for his opening remarks. 


### 
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Opening Statement: Ranking Member Price 

Mr. Price. Thank you, Mr. Chairman. And I want to add my 
welcome to Deputy Under Secretary Suzanne Spaulding from the 
National Protection and Programs Directorate; and Assistant Di- 
rector Steven Caldwell from the GAO. Thank you for being here. 
You are here to discuss the status of the Chemical Facility Anti- 
Terrorism Security Standards, commonly referred to as CFATS. 

The Department of Homeland Security is required to identify and 
assess high risk chemical facilities and to ensure their security. 
The department has required chemical facilities to complete a so- 
called top screen for potential dangerous materials to identify 
vulnerabilities and to develop a site security plan. To date more 
than 40,000 top screens have been submitted by chemical facilities. 
From this pool over 7,000 facilities were initially designated as 
high risk and were required to submit security vulnerability as- 
sessments to NPPD, although this number has decreased some- 
what over time. Earlier this year CFATS covered just under 4,500 
high risk facilities nationwide, which are further stratified into four 
risk tiers. 

We all acknowledge that a lot of work has taken place to date 
to identify and classify the high risk chemical facilities. But NPPD 
has still a long way to go. Numerous concerns have been raised 
about the speed at which the security vulnerability assessments 
have been reviewed and the site security plans approved. For ex- 
ample, less than one year ago NPPD had only conducted one secu- 
rity vulnerability assessments. While that figure has now grown to 
63, it may be years before all of the security assessments are final- 
ized. And, as of today, no site security plan has been approved, al- 
most five years after Congress implemented this statutory require- 
ment. According to recent GAO data it may date up to ten years 
before all site security plans are approved. That is simply not an 
acceptable time frame. 

Although NPPD is years away from completing its work, unfortu- 
nately this subcommittee recommended a cut of over $29 million to 
infrastructure security compliance’s fiscal year 2013 request be- 
cause of a lack of progress in the Chemical Facility Anti-Terrorism 
Standards program. Now it is true, this program has accumulated 
high unobligated balances from prior years. But while I share the 
chairman’s concern over the high unobligated balances, I believe 
this subcommittee’s cuts go too far and in fact are quite counter- 
productive. They will affect NPPD’s ability to do the very things we 
are asking you to do, being able to move ahead on CFATS and on 
the management concerns identified by the agency’s internal re- 
view and follow on action plans. 

Ms. Spaulding, it was imperative to develop and implement an 
action plan to correct these management problems. Six months 
after your plan was completed only about half of the 94 action 
items have been closed, the rest have outstanding actions. Mr. 
Caldwell, since the chairman and I requested GAO to look into 
these issues further, I look forward to your update on where NPPD 
stands on these corrective actions and what further recommenda- 
tions you have planned to address these concerns. 
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Finally, we have also heard numerous concerns about the vetting 
of chemical security personnel, which the House Appropriations bill 
does address as you know. Just this week this committee learned 
that NPPD was dropping the personnel surety component. Putting 
the merits of this decision aside, I am concerned that the com- 
mittee did not know about this, and was not notified of this change 
by the department. Unfortunately this lack of notification is not the 
first time. There is a disturbing trend of leaving appropriators in 
the dark and this hinders our ability to provide adequate funding 
to carry out key missions. So Ms. Spaulding I am going to want you 
to explain the recent decision and lay out the path forward on per- 
sonal surety. 

Deputy Under Secretary Spaulding, Assistant Director Caldwell, 
we look forward to your testimony. I think we would all agree that 
this nation needs a robust chemical security program and we are 
hopeful you can shed light on the challenges that currently face 
this effort. 

[The information follows:] 
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Opening Statement by Ranking Member David Price 
Chemical Facility Anti-Terrorism Security Hearing 
July 26, 2012 

I’d like to welcome Deputy Under Secretary Suzanne Spaulding from the 
National Protection and Programs Directorate (NPPD) and Assistant Director 
Stephen Caldwell from the Government Accountability Office (GAO) to discuss 
the status of the chemical facility anti -terrorism security standards, commonly 
referred to as CFATS. DHS is required to identify and assess high-risk chemical 
facilities and to ensure their security. The Department has required chemical 
facilities to complete a top-screen for potential dangerous materials, to identify 
vulnerabilities, and to develop a site security plan. To date, more than 40,000 top 
screens have been submitted by chemical facilities. From this pool, over 7,000 
facilities were initially designated as high-risk and were required to submit security 
vulnerability assessments to NPPD, although this number has decreased over time. 
Earlier this year, CFATS covered just under 4,500 high-risk facilities nationwide, 
which are further stratified into four risk tiers. 

While we all acknowledge that a lot of work has taken place to date to 
identify and classify the high risk chemical facilities, NPPD still has a long way to 
go. Numerous concerns have been raised about the speed at which the security 
vulnerability assessments have been reviewed and site security plans approved. 

For example, less than one year ago, NPPD had only conducted one security 
vulnerability assessment. While this figure has now grown to 63, it may be years 
before all vulnerability assessments are finalized. And, as of today, no site security 
plan has been approved — almost five years after Congress implemented this 
statutory requirement. According to recent GAO data, it may take up to 10 years 
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before all site security plans are approved. This is a simply unacceptable 
timeframe. 

Although NPPD is years away from completing its work, this Subcommittee 
unfortunately recommended over a $29 million cut to Infrastructure Security 
Compliance’s fiscal year 2013 request because of a lack of progress in the 
Chemical Facility Anti-Terrorism Standards program. The program has in fact 
accumulated high unobligated balances from prior years. But while I share the 
Chairman’s concern over the high unobligated balances, I believe the 
Subcommittee’s cuts go too far and in fact are counterproductive. They will affect 
NPPD’s ability to do the very things we are asking them to do. . .namely to move 
ahead on CFATS and on the mismanagement concerns identified by the agency’s 
internal review and follow-on action plan. 

Ms. Spaulding, it was imperative to develop and implement an action plan to 
correct these mismanagement problems. Six months after your plan was 
completed, only about half of the 94 action items have been closed. The rest have 
outstanding actions. Mr. Caldwell, since the Chairman and I requested GAO to 
look into these issues further, I look forward to your update on where NPPD stands 
on these corrective actions and what further recommendations you may have 
planned to address these concerns. 

Finally, we have also heard numerous concerns about the vetting of 
chemical security personnel, which the House appropriations bill seeks to rectify. 
Just this week, this Committee learned that NPPD was dropping the personnel 
surety component. Putting the merits of this decision aside, I am concerned that the 
Committee was not notified of this change by the Department. This lack of 
notification continues a disturbing trend at DHS of leaving Appropriators in the 
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dark, and it only hinders our ability to provide adequate funding to carry out key 
missions. Ms. Spaulding, I would appreciate you explaining the recent decision 
and laying out the path forward on personnel surety. 

Deputy Under Secretary Spaulding and Assistant Director Caldwell, I look 
forward to your testimony. I think we would all agree that this nation needs a 
robust chemical security program, and we are hopeful that you can shed light on 
the challenges currently facing this effort. 
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Mr. Aderholt. Thank you. Thank you, Mr. Price. Let me begin, 
Mr. Caldwell, if you would give your opening statement we would 
appreciate it. 

Opening Statement: Director Steve Caldwell 

Mr. Caldwell. Thank you. I will be very brief. I know that we 
have votes coming up for the members here. So Chairman Ader- 
holt, and Mr. Price. I thank you for holding this hearing. I would 
like to submit my document, my statement for the record. We have 
worked very closely with NPPD to try to better understand what 
the challenges are that it faces and what plans they have for re- 
solving those, and we will continue to work with them and the com- 
mittee on this issue. Thank you sir. I am ready for questions, if 
there is time later. 

[The information follows:] 
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CRITICAL INFRASTRUCTURE PROTECTION 

DHS Is Taking Action to Better Manage Its Chemical 
Security Program, But It Is Too Early to Assess 
Results 


What GAO Found 

The November 2011 memorandum that discussed the management of the 
Chemical Facility Anti-Terrorism Standards (CFATS) program was prepared 
based primarily on the observations of the Director of the Department of 
Homeland Security’s (DHS) Infrastructure Compliance Security Division (ISCD), 
a component of the Office of Infrastructure Protection (IP) within the National 
Protection and Programs Directorate (NPPD). The memorandum was intended to 
highlight various challenges tiiat have hindered ISCD eflbrts to implement the 
CFATS program. According to the Director, the challenges facing ISCD included 
not having a fully developed direction and plan for implementing the program, 
hiring staff without establishing need, and inconsistent ISCD leadership-factors 
that the Director believed place the CFATS program at risk. These challenges 
centered on human capital issues, including problems hiring, training, and 
managing ISCD staff; mission issues, including overcoming problems reviewing 
facility plans to mitigate security vulnerabilities and performing compliance 
inspections; and administrative issues, including concerns about NPPD and IP 
not supporting ISCD’s management and administrative functions. 

ISCD has begun to take various actions intended to address the human capital 
management, mission, and administrative issues identified in the ISCD 
memorandum and has developed a 94-item action plan to track its progress. 
According to ISCD managers, the plan appears to be a catalyst for addressing 
some of the long-standing issues the memorandum identified. As of June 2012, 
ISCD reported that 40 percent (38 of 94) of the items in the plan had been 
completed. These include (1 ) requiring ISCD managers to meet with staff to 
involve them in addressing challenges, clarifying priorities, and changing ISCD’s 
culture and (2) developing a proposal to establish a quality control function over 
compliance activities. The remaining 60 percent (56 of 94) that were In progress 
include those requiring longer-term efforts— i.e., streamlining the process for 
reviewing facility security plans and developing facility inspection processes; 
those requiring completion of other items in the plan: or those awaiting action by 
others, such as approvals by ISCD leadership. ISCD appears to be heading in 
the right direction, but it is too early to tell if individual items are having their 
desired effect because ISCD is in the early stages of implementing corrective 
actions and has not established performance measures to assess results. 

Moving forward, exploring opp>ortunities to develop measures, where practical, to 
determine where actual performance deviates from expected results, consistent 
with Internal control standards could help ISCD better identify any gaps between 
actual and expected results so that it can take further action, where needed. For 
example, as ISCD develops a new security plan review process, it could look for 
ways to measure the extent to which the time to do these reviews has been 
reduced as compa’ed with the time needed under the current review process. 

According to ISCD officials, almost half of the action items included in the June 
2012 action plan require ISCD collaboration with or action by NPPD and IP. The 
ISCD memorandum stated that IP and NPPD did not provide the support needed 
to manage the CFATS program when the program was first under development. 
ISCD, IP. and NPPD officials confirmed that IP and NPPD are prodding needed 
support and stated that the action plan prompted them to work together to 
address the various human capital and administrative issues identified. 
United States Government Accountability Office 
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Chairman Aderholt, Ranking Member Price, and Members of the 
Subcommittee: 

I am pleased to be here today to discuss the Department of Homeland 
Security's (DHS) efforts to address various challenges in implementing 
and managing the Chemical Facility Anti-Terrorism Standards (CFATS) 
program. The events of September 1 1 , 2001 , triggered a national re- 
examination of the security of facilities that use or store hazardous 
chemicals in quantities that, in the event of a terrorist attack, could put 
large numbers of Americans at risk of serious injury or death. Chemicals 
held at these facilities can be used to cause harm to surrounding 
populations during terrorist attacks, can be stolen and used as chemical 
weapons or as precursors (the ingredients for making chemical 
weapons), or stolen and used to build an improvised explosive device. To 
mitigate this risk, the DHS appropriations act for fiscal year 2007' 
required DHS to issue regulations to establish risk-based performance 
standards for securing high-risk chemical facilities.^ DHS established the 
CFATS program to assess the risk, if any, posed by chemical facilities; 
place high-risk facilities in one of four risk-based tiers; require high-risk 
facilities to develop security plans; review these plans; and inspect the 
facilities to ensure compliance with the regulatory requirements. DHS's 
National Protection and Programs Directorate (NPPD) is responsible for 
the CFATS program. Within NPPD, the Infrastructure Security 
Compliance Division (ISCD), a component of the Office of Infrastructure 
Protection (IP), manages the program. 

A November 201 1 internal ISCD memorandum, prepared by ISCD's 
Director in consultation with the Deputy Director, has raised concerns about 
the management of the CFATS program. The ISCD memorandum, which 
was leaked to the media in December 2011, cited an array of challenges 
that, according to these officials, hindered ISCD's ability to implement and 
manage the CFATS program^ My statement today discusses 


'Pub. L. No. 109-295, § 550, 120 Stat. 1355, 1388 (2006). 

^According to DHS, a high-risk chemical facility is one that, in the discretion of the 
Secretary of Homeland Security, presents a high ri^ of significant adverse consequences 
for human life or health, national security, or critical economic assets if subjected to a 
terrorist attack, compromise, infiltration, or exploitation. 6 C.F.R. § 27.105. 

^According to DHS officials, the ISCD memorandum v^as never intended to be publicaiiy 
released. 
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• how the memorandum was developed and what challenges were 
identified; 

• what actions are being taken to address the challenges identified: and 

• the extent to which ISCD’s planned actions and proposed solutions 
require action to be taken by or in collaboration with NPPD or IP. 

This statement today is based on work we recently completed for you on 
this ISCD memorandum and related actions. To conduct this work, we 
reviewed applicable laws and regulations, as well as NPPD, IP, and ISCD 
policies and procedures for administering the CFATS program. We also 
analyzed the ISCD memorandum prepared by the ISCD Director in 
consultation with the Deputy Director, compared it with the proposed 
action plan ISCD officials prepared to address the challenges identified, 
and compared subsequent action plans to monitor ISCD’s progress.'* We 
interviewed senior ISCD officials (including the ISCD Director and Deputy 
Director) to discuss the challenges identified and planned corrective 
actions. We also interviewed NPPD and IP officials to obtain their views 
on the causes for the challenges, tSCD’s proposed actions, and their 
roles in working with ISCD to address the challenges. We obtained and 
reviewed available documentation (e.g., standard operating procedures 
and ISCD memos) relevant to each action item. Finally, we compared the 
results of our analysis of the proposed action plan, and our discussions 
with DHS, NPPD, IP, and ISCD officials, with various criteria, including 
the CFATS law and regulations: DHS policies, procedures and reports; 
Standards for Internal Control in the Federal Government,^ The Standard 


*We initially reviewed an ISCD action plan developed in January 2Q12. ISCD periodically 
updated the plan to monitor progress on the action items and we reviewed eight versions 
of the action plan up to and including one developed in June 2012. 

®GAO, Standards for Internal Control in the Federal Government, GAO/AIMD 00-21.3.1 
(Washington. D C.: November 1999). Internal control is an integral component of an 
organization’s management that provides reasonable assurance that the following 
objectives are being achieved; eriectiveness and efficiency of operations, reliability of 
rinanctal reporting, and compliance with applicable iav^ and regulations. These standards, 
issued pursuant to the requirements of the Federal Managers' Financial Integrity Act of 
1982 (FMFIA), provide the overall framework for establishing and maintaining internal 
control in the federal government. Also pursuant to FMFIA, the Office of Management and 
Budget issued Circular A-123. revised December 21 . 2004, to provide the specific 
requirements for assessing and reporting on internal controls. Internal cantrot standards 
and the definition of internal control in Circular A-123 are based on GAO's Standards for 
Intemal Confro/ in the Federal Govemmeni 
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for Program Martagement,^ and past GAO and DHS Office of Inspector 
General (OIG) reports/ We identified limitations that should be 
considered when using our results. For example, the ISCD memorandum 
represented the views of the senior ISCD officials that prepared the 
memorandum and may not be representative of the views of other 
officials within the CFATS program. Also, our results are based on ISCD's 
action plan as of June 20t2 so these results reflect the status of ISCD’s 
progress up to that point in time. 

We conducted this performance audit from February 2012 to July 2012 in 
accordance with generally accepted government auditing standards. 
Those standards require that we plan and perform the audit to obtain 
sufficient, appropriate evidence to provide a reasonable basis for our 
findings and conclusions based on our audit objectives. We believe that 
the evidence obtained provides a reasonable basis for our analysis based 
on our audit objectives. Appendix 1 discusses our scope and methodology 
and related limitations in greater detail. 


Background 


The CFATS program is intended to secure the nation’s chemical 
infrastructure by identifying and protecting high-risk chemical facilities. 
Section 550 of the DHS appropriations act for fiscal year 2007 requires 
DHS to issue regulations establishing risk-based performance standards® 
for security of facilities that the Secretary determines to present high 
levels of security risk.® The CFATS rule was published in April 2007’® and 


^Project Management institute, The Standard for Program Management© (Newtowi 
Square, Pa: 2006). The Standard for Program Management provides guidelines for 
successfully managing programs and projects. 

^GAO, Homeland Security: Voluntary Initiatives Are Under Way at Chemical Facilities, but 
the Extent of Security F^paredness Is Unknown, GAO-03-439 (Washington. D.C.: March 
2003; OHS OIG. Use of DHS Purchase Cards, OIG-1 1-101 (Washington D.C.: August 
201 1 ; and DHS OIG, The Preparedness Dii^orate 's Antt-DeTtciency Act Violations for 
Fiscal Year 2006 Shared Service Administrative Assessment] OIG-12'21 (Washington 
D C.; December 201 1 ). 

®The CFATS rule establishes 18 risk-based performance standards that identtfy the areas 
for \^^ich a facility's security posture are to be examined, such as perimeter security, 
access <»ntrol. and cyber security. To meet these standards, facilities are free to choose 
whatever security programs or processes they deem appropriate so long as DHS 
determines that the fadiities achieve the requisite level of performance in each of the 
applicable areas. 

®Pub. L No. 109-295, § 550. 120 Slat 1355, 1388 (2006). 
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Appendix A to the rule, published in November 2007, listed 322 chemicals 
of interest and the screening threshoid quantities amount for each.” 
According to the CFATS ruie, any faciiity that possesses (or later comes 
into possession of) any of these chemicais in quantities that meet or 
exceed the threshold is required to submit certain information to DHS for 
screening. According to the ruie, if DHS preiiminariiy determines that a 
facility is high risk— that is, the facility presents a high risk of significant 
adverse consequences for human ilfe or health, national security, or 
critical economic assets if subjected to terrorist attack, compromise, 
infiltration, or exploitation — the facility must submit a security vulnerability 
assessment to DHS that identifies security vulnerabilities at the site, 
among other things. After reviewing the security vulnerability assessment, 
DHS then makes a final decision as to whether the facility is high-risk 
and, if so, assigns the facility to a final tier. The rule then requires 
facilities that have been finally determined to be high-risk to develop and 
submit for DHS approval site security plans that generally show how they 
are to address the vulnerabilities identified in the vulnerability 
assessment, including measures that satisfy applicable risk-based 
performance standards. In addition, the rule requires that DHS implement 
a compliance inspection process to ensure that covered facilities are 
satisfying DHS's performance standards consistent with their approved 
site security plans, 

ISCD has direct responsibility for implementing DHS's CFATS rule, 
including assessing potential risks and identifying high-risk chemical 
facilities, promoting effective security planning, and ensuring that final 
high-risk facilities meet the applicable risk-based performance standards 
though site security plans approved by DHS. iSCD is managed by a 
Director and a Deputy Director and operates five branches that are, 
among other things, responsible for information technology operations. 


’°72Fed, Reg, 17,688 (Apr. 9, 2007) (codified at 6 C.F.R. pt. 27), 

”72 Fed. Reg. 85,396 (Nov. 20, 2007). According to DHS, CFATS not only covers 
facilities that manufacture chemicals but also covers facilities that store or use certain 
chemicals as part of their daily operations. This can include food-manufacturing fadiities 
that use chemicals of interest in the manufacturing process, farms that use certain 
quantities of ammonium nitrate or urea fertilizers, or universities that use chemicals to do 
experiments, 

^^According to OHS offidals. tiering determinations are dynamic; for example, a tiering 
determination can change when a company voluntarily alters its fadiities in a vray that 
reduces its risk profile. These officials stated that 'final tiering" refers to a tiering 
assignment foltovwng a security vulnerability assessment— it does not imply that this is the 
final tiering assignment a fadlity may ever receive. 
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policy and planning; providing compliance and technical support; 
inspecting facilities and enforcing CFATS regulatory standards; and 
managing logistics, administration, and chemical security training. ISCD 
receives business support from NPPD and IP for services related to 
human capital management and training, budget and finance, and 
acquisitions and procurement. Figure 1 shows iSCD’s current 
organizational structure within NPPD and IP. Appendix II provides a more 
detailed organization chart showing the various ISCD divisions. 


Figure 1: NPPO, iP, and ISCD Organizational Structure 


National Protection & Programs Directorate (NPPD) 


Office of Infrastructure Protection (IP) 


I Irifrastfucture Seairily Comfriiance DivisiQn (ISCD) 
Source. GAO analysts ol KPPD. IP and ISCO organuahonal chans 


From fiscal years 2007 through 2012, DHS dedicated about $442 million 
to the CFATS program. During fiscal year 2012, ISCD was authorized 
242 full-time-equivalent positions. For fiscal year 2013, DHS's budget 
request for the CFATS program was $75 million and 242 positions. 


The CFATS Rule DHS's CFATS rule outlines a specific process for administering the 

program. Any chemical facility that possesses any of the 322 chemicals in 
the quantities that meet or exceed the threshold quantity outlined in the 
rule is required to complete an initial screening tool (referred to by DHS 
as the Top Screen) whereby the facility provides DHS various data, 
including the name and location of the facility and the chemicals and their 
quantities at the site.’’ DHS is to use this information to initially determine 
whether the facility is high risk. If so, DHS is to notify the facility of its 
preliminary placement in one of four risk-based tiers— -tier 1 , 2, 3, or 4. 


’ ^For example, under the CFATS rule, a facility that possesses butane at a quantity equa! 
to or exceeding 10,000 pounds must submit information to DHS because the substance is 
considered flammable if subject to release. A facility possessing another chemical, 
hydrogen cyanide, would have to submit information to OHS if it possessed a quantity 
equal to or exceeding 15 pounds of the substance, which, according to the rule, is 
considered vulnerable to theft for use as a weapon of mass effect. 
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Facilities preliminarily placed in any one of these tiers are considered to 
be high risk, with tier 1 facilities considered to be the highest risk. 
Facilities that DHS initially determines to be high risk are required to 
complete a security vulnerability assessment, which includes the 
identification of potential critical assets at the facility and a related 
vulnerability analysis. '* DHS is to then review the security vulnerability 
assessment and notify the facility of DHS’s final determination as to 
whether or not it is considered high risk, and If the facility is determined to 
be a high-risk facility about its final placement in one of the four tiers. 
Once this occurs, the facility is required to submit a site security plan or 
participate in an alternative security program in lieu of a site security 
plan.’* The security plan is to describe the security measures to be taken 
to address the vulnerabilities identified in the vulnerability assessment, 
and identify and describe how security measures selected by the facility 
will address the applicable risk-based performance standards. DHS then 
is to do a preliminary review of the security plan to determine whether it 
meets the regulatory requirements. If these requirements appear to be 
satisfied, DHS issues a letter of authorization for the facility's plan. DHS 
then conducts an authorization inspection of the facility and subsequently 
determines whether to approve the security pian. If DHS determines that 
the plan does not satisfy CFATS requirements (based on its preliminary 
review after an authorization inspection), DHS then notifies the facility of 
any deficiencies and the facility must submit a revised plan correcting 
those deficiencies. If the facility fails to correct the deficiencies, DHS may 
then disapprove the plan. Following approval, DHS may conduct further 
inspections to determine if the facility is in compliance with its approved 
security plan. Figure 2 illustrates the CFATS regulatory process. 


’^Preliminary tier 4 facilities also have the option of submitting an alternate security pian in 
iieu of a seojrrty vulnerability assessment. 

^®Under the CFATS a»le. an alternative security program is defined as a third-party or 
industry organization program; a local authority, state, or federal government program; or 
any element or aspect thereof that the Assistant Secretary for Infrastructure Protection 
has determined meets the requirements of the rule and provides for an equivalent level of 
security to that established by the rule. 
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Figure 2: DHS Chemical Facility Anti'TerrorIsm Standards (CFATS) Regulatory 
Process 


Regulated 



^Facilities are to submtt an inifiai SCTeening loo! that provides basic information about the facility and 
the chemit^is Urey possess. 


'This step includes determining if a facility is high- risk, and if so, DHS assigns a tier and identifies 
security issues, 

'At this stage, if requirements are satisfied. DHS issues a letter of authorization for the facility's plan, 


In July 2007, DHS began reviewing information submitted by 
approximately 40,000 facilities. By January 2012, DHS had preliminarily 
determined that approximately 4,500 of these facilities were high risk and 
preliminarily placed each in one of the four tiers. Each of these 
approximately 4,500 facilities was to complete a security vulnerability 
assessment, and those facilities that DHS finally determined to be high 
risk were to submit a site security plan. According to ISCD officials, the 
vulnerability assessment process prompted over 1 ,600 facilities to 
remove chemicals of interest from their sites, thereby enhancing their 
security posture and removing them from CFATS coverage. Also, 
according to division officials, as of February 2012, ISCD had worked with 
facilities to complete 925 compliance assistance visits whereby division 
inspectors visit high-risk facilities to provide knowledge of and assistance 
in complying with CFATS, particularly facilities that were in the process of 
preparing their security plans. 


Page? 


GAO-1Z-615T 




19 


Senior ISCD Leaders 
Developed the ISCD 
Memorandum to 
Highlight Various 
Challenges Hindering 
CFATS 

Implementation 


ISCD’s Memorandum 
Based Largely on 
Observations of Senior 
ISCD Managers 


Our review of the ISCD memorandum and discussions with ISCD officials 
showed that the memorandum was developed during the latter part of 
201 1 and was developed primarily based on discussions with ISCD staff 
and the observations of the ISCD Director in consultation with the Deputy 
Director. In July 201 1 , a new Director and Deputy Director were 
appointed to lead ISCD and, at the direction of NPPD’s Linder Secretary, 
began a review of the CFATS program goals, challenges, and potential 
corrective actions.’® In November 201 1, the Director and Deputy Director 
provided the Under Secretary the ISCD memorandum entitled 
"Challenges Facing ISCD, and the Path Forward.” These officials stated 
that the memorandum was developed to inform leadership about the 
status of ISCD, the challenges it was facing, and the proposed solutions 
identified to date. In transmitting a copy of the memorandum to 
congressional stakeholders following the leak in December 2011, the 
NPPD Under Secretary discussed caveats about the memorandum. He 
stated that the memorandum was not a formal compliance audit or 
program review and in several instances it lacked useful, clarifying 
context. He stated that the ISCD memorandum was not intended for 
wider internal or external dissemination beyond the Under Secretary’s 


’®Also prior to July 2011, a former Acting ISCD Director established a working group to 
address problems related to the original risk assessment computer model problems. The 
working group was established because iSCD had determined that that some high-risk 
chemical facilities had been incorrectiy categorized. According to the ISCD memorandum, 
the incorrect categorization called into question the credibitity of the program. ISCD 
determined that about 500 facilities were potentially affected by a data error in the original 
model, which resulted in changes to many of those facilities' final tier levels or other 
changes to their final tier results, including some facilities no longer being considered 
high-risk. 
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office. He further explained that it had not undergone the normal review 
process by DHS's Executive Secretariat and contained opinions and 
conclusions that did not reflect the position of DHS. He also noted that the 
memorandum did not discuss the “significant progress" ISCD had made 
to date reaching out to facilities of concern to improve their security 
posture. For example, senior division officials toid us that the 
memorandum did not note the positive impact of ISCD's initial screening 
of facilities, which resulted in many facilities reducing their holdings of 
regulated materials so that they would no longer be subject to the rule. 

The ISCD Director confirmed that she was the primary author of the ISCD 
memorandum, in consultation with the Deputy Director, and said that the 
memorandum was intended to be used as an internal management tool. 
The Director stated that when she was brought onboard, the Under 
Secretary tasked her to look at CFATS from an outsider’s perspective and 
identify her thoughts on the program relative to other regulatory regimes, 
particularly in light of growing concerns about possible human capital 
issues and problems tiering chemical facilities covered by CFATS. She 
confirmed that the memo was intended to begin a dialog about the 
program and challenges it faced. The Director also confirmed that she 
developed the memorandum by (1) sun/eying division staff to obtain their 
opinions on program strengths, challenges, and recommendations for 
improvement; (2) obsen/ing CFATS program operations including the 
security plan review process; and (3) analyzing an internal DHS report on 
CFATS operations," which, according to the Director, served as a basis 
for identifying some administrative challenges and corrective action. The 
Director told us that senior ISCD officials, including branch chiefs, were 
given an opportunity to review an initial draft of the memorandum and 
provided feedback on the assumptions presented. ISCD branch chiefs — 
the officials responsible for taking corrective actions — confirmed that they 
were given the opportunity to provide comments on a draft of the 
memorandum. However, they said that after the leak, almost all of the 
senior ISCD officials, including branch chiefs, did not have access to the 
final memorandum per the instruction of the Under Secretary for 
Management. The senior ISCD and NPPD officials we contacted said that 
they generally agreed with the material that they saw, but noted that they 
believed the memorandum was missing context and balance. For 


"DHS Office of Compliance and Security, National Protection and Programs Directorate, 
Infmstructum Security Compliartce Division (ISCD) Program Inspection, April-September, 
2011 . 
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example, one NPPD official stated that that the tone of the memorandum 
was too negative and the problems it discussed were not supported by 
sound evaluatbn. The official expressed the view that the CFATS 
program is now on the right track. 


ISCD Director Was 
Concerned That 
Challenges Place the 
CFATS Program at Risk 


The ISCD memorandum discussed numerous challenges that, according 
to the Director, pose a risk to the program. The Director pointed out that, 
among other things, ISCD had not approved any site security plans or 
carried out any compliance inspections on regulated facilities. The 
Director attributed this to various management challenges, including a 
lack of planning, poor internal controls, and a workforce whose skills were 
inadequate to fulfill the program’s mission and highlighted several 
challenges that have an impact on the progress of the program. In 
addition, the memorandum provided a detailed discussion of the issues or 
problems facing ISCD, One group of issues focused on human capital 
management, problems the author categorized as team issues. According 
to the Director, these included issues arising out of poor staffing 
decisions; difficulty establishing a team culture that promotes 
professionalism, respect, and openness; a lack of measurable employee 
performance goals and unclear performance and conduct standards; and 
potential delays associated with notifying ISCD inspector union over 
policies, procedures, and processes, A second group focused on mission 
issues, including what the author found to be the slow pace of the site 
security plan approval process, the lack of an established Inspection 
process, and the ISCD's inability to perform compliance inspections 51/2 
years after enactment of the CFATS statute, and the lack of an 
established records management system to document key decisions. A 
third group focused on administrative issues, particularly those the 
Director regarded as a lack of Infrastructure and support, both within 
ISCD and on the part of NPPD and IP. They included the aforementioned 
concern about over-reliance on contractors, insufficient and inconsistent 
support by NPPD and IP with regard to human capital needs— including 
support on the aforementioned staffing issues — and insufficient controls 
regarding the use of inspector vehicles, purchase cards, and travel. 

Additional details on the human capital, mission, and administrative 
issues identified in the ISCD memorandum are considered "for official use 
only," 
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ISCD Has Begun to 
Take Various Actions 
Intended to Address 
Challenges Identified 


ISCD’s Action Plan 
Includes Time Frames for 
Completing Action Items 
and Appears to Be a 
Catalyst for Addressing 
Some Legacy Issues 


iSCD is using an action plan to track its progress addressing the 
chaiienges identified in the memorandum, and, according to senior 
division officials, the plan may be helping them address some legacy 
issues that staff were attempting to deal with before the memorandum 
was developed. As discussed earlier, the ISCD memorandum was 
accompanied by a proposed action plan that, according to the director, 
was intended to provide proposed solutions to the challenges identified. 
The January 2012 version of that plan listed 91 actions to be taken 
categorized by issue — human capital management issues, mission 
issues, or administrative issues — that, according to the ISCD Director, 
were developed to be consistent with the ISCD memorandum. Each 
action item also listed the coordinator, or individual or unit responsible for 
the action, and discussed the status of the action, including whether the 
item was complete or in progress. For example, In the human 
capital/staffing issues area, one action item was intended to engage ISCD 
leadership to develop an integration plan for newly hired employees. The 
IP Business Support Team, which is co-located with iSCD, was 
responsible for coordinating this action, and at the time the plan was 
prepared, the action was in progress. According to the plan, a 3-day ISCD 
101 course had been developed and a more comprehensive process for 
acclimating new employees to ISCD was under development. However, 
the January 2012, version of the action plan did not provide information 
on when the action was started or to be finished. 


In February 2012, ISCD developed a version of the action plan that 
included the same information as the January 2012, plan. However, it 
also included quarterly projected completion dates. Since then the 
division's action plan has evolved into a more detailed plan containing 94 
items. Like the February 2012 plan, March and June 2012 updated 
versions of the plan contained information on the coordinator, the action 
to be taken, and the status of each item. However, unlike the February 
2012 version of the plan, the March and June versions of the plan 
provided detailed milestones and timelines for completing action items 
including calendar dates, and interim actions leading to completion— 
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essentially a road map for managing each action item according to 
particular dates and milestones.^® This approach is consistent with The 
Standarxi ior Program Management, which calls for organizations to 
develop plans with milestones and time frames to successfully manage 
programs and projects.’^ 

Eleven of the 1 2 ISCD managers (those other than the Director and 
Deputy Director) assigned to work as the coordinators of the individual 
action items told us that even though they were not given the opportunity 
to view the final version of the ISCD memorandum, the Director provided 
them the sections of the action plan for which they were responsible to 
help them develop and implement any corrective actions, They said that 
they agreed that actions being taken in the plan were needed to resolve 
challenges facing ISCD. Our discussions with these officials also showed 
that about 39 percent (37 of 94) of the items in the March and June 2012 
action plans addressed some legacy issues that were previously 
identified and. according to these officials, corrective actions were already 
under way for all 38 of these action items. For example, one action item 
called for ISCD to maintain better relations with industry. Congress, and 
other key stakeholders. ISCD officials said that the ISCD Policy Branch 
had already begun working on this strategy prior to the development of 
the memorandum and action plan and that this strategy was given more 
attention and a higher priority because of the associated action item. An 
ISCD official expressed the view that the ISCD memorandum and action 
plan encouraged ISCD to address these and other items sooner than they 
otherwise might have been addressed. 


ISCD’s June 2012 Plan Our analysis of the June 201 2 version of the ISCD action plan showed 

Update Showed 38 Action percent of the items in the plan (38 of 94) had been completed. 

Items Completed remaining 60 percent (56 of 94) were in progress. Our analysis of the 

38 completed items showed that 32 of the 38 items were associated with 
human capital management and administrative issues, including those 


^®tSCD updated this vefsion of the plan, whtcrfi is intended to be for official use only, in 
April 2012 and submitted it to Members of Congress for informationai purposes and 
updated this version again in June 2012. However, the version of the plan submitted to 
Members of Congress did not contain detailed time frames and milestones; rather it 
showed timeframes by quarters mudi like the Feboiary version of the plan. Our analysis 
focused on the detailed version of the plan to help us better assess ISCD's progress. 

’^Project Management Institute. The Standard for Program Management. 
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involving culture and human resources, contracting, and documentation. 
For example, one human capital management issue that is complete 
called for ISCD to survey staff to obtain their opinions on program 
strengths and challenges and recommendations for program 
improvements. According to the June 2012 action plan, the survey was 
completed and ISCD’s action plan showed the item as completed on 
January 10. 2012. Another completed human capital action item- 
categorized by ISCD as a cultural issue — called for ISCD management to 
hold a series of meetings with employees to involve them in addressing 
program challenges, clarity program priorities related to its mission, and 
implement changes in ISCD culture. The June 2012 version of the action 
plan shows the item as completed on January 10, 2012, but noted that 
this activity will continue going fonward. The remaining 6 of 38 action 
items categorized by ISCD as completed were associated with mission 
issues such as 1 action item calling for ISCD to establish a quality control 
function for compliance and enforcement activities. According to iSCD’s 
action plan, this item was completed in April 2012, based on development 
of a proposal to form the quality control section within the division. Figure 
3 shows the status of action items by each of the three categories — 
human capital management issues, mission issues, and administrative 
issues, as of June 2012. Appendix III provides an overview of the items in 
the action plan and their status (completed or in progress) by issue 
(human capital management, mission issues, and administrative issues) 
and subcategory. 
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Figure 3: Status of ISCD Action Plan by issue, as of June 2012 

nges Mission issue chailenges 
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For the remaining 56 items that were in progress, 40 involved human 
capital management and administrative issues. According to ISCD 
officials, these 40 issues generally involved longer-term efforts — such as 
organizational realignment— or those that require approval or additional 
action on the part of IP or NPPD. For example, ISCD reported that there 
are 1 3 action items that are directly or Indirectly associated with the 
division's realignment efforts, including items that require approval by 
NPPD and IP. The overall realignment effort related to these action items 
is intended to address concerns, highlighted in the memorandum, that 
ISCD's organizational structure was "stovepiped” and compartmentalized. 
The plan, which, as of June 2012, was in draft, would, according to 
officials, reorganize ISCD to "integrate more fully certain functions to 
enhance the collaborative nature of the work that needs to be performed" 
and would entail creating new offices, moving and integrating others, and 
centralizing some functions that are now dispersed throughout the 
division. In accordance with the affected action items, ISCD and a 
contractor developed the several elements of the realignment plan for 
review, and ISCD was awaiting input or guidance from NPPD and IP 
before associated action items can be completed. 

Sixteen of 56 remaining actions items in progress covered mission issues 
that will likely also require long-term efforts to address. For example, 1 of 
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these mission-related action items entails the development of 
requirements for an Information technology platform to support inspection 
activities. Another entails the development of plans to improve ISCD's site 
security plan review process. Regarding the latter, ISCD encountered 
delays approving security plans because, according to ISCD officials, the 
quality of the plans submitted was inconsistent and ISCD did not have 
dedicated staff with the skills needed to work with facilities to review and 
approve them. As noted in the ISCD memorandum, the site security plan 
review process was overly complicated, did not leverage available 
resources, and created bottlenecks and clearing the backlog of security 
plan's was ISCD’s highest priority.^® To address these concerns, ISCD 
developed an interim review process to clear the backlog of tier 1 security 
plans with a goal of completing reviews of those plans by the end of the 
calendar year. ISCD began to track the action item intended to develop a 
plan for introducing a new security plan review process, which, according 
to the June 2012 action plan, is supposed to be completed in July 2012. 
The development of a new security plan review process may be critical to 
the effective implementation of the CFATS program. According to an 
ISCD official, compliance inspections cannot begin until ISCD reviews 
and approves a facility's site security plan. In March 2012, the official 
estimated that it could take at least 18 months for ISCD to complete its 
first compliance inspections. In commenting on our draft statement. ISCD 
officials stated that inspections for all of the approximately 4,500 tiered 
facilities could take several years, contingent upon available resources. 


^®According to the ISCO memorandum, clearing the backlog of site security plans was one 
of the top three priorities for beginning to address the challenges facing tSCD. One of the 
other two was developing a chemical inspection process, v^ich is a ionger-tenn effort that 
is being addressed via the action plan, in part, by an ISCO Inspection Working Group, llie 
remaining high-priority item dealt with efforts to address ISCO management regarding its 
statutory responsibilities for regulating ammonium nitrate and manage personnel surety as 
part of the CFATS program. Regarding the latter, personnel surety is one of the CFATS 
performance standards. As such, DHS requires facilities to perform background checks on 
and ensure apprc^riate credentials for facility personnel and DHS is required to check for 
terrorist ties by comparing certain employee information with its terrorist screening 
database. DHS’s plan for collecting these data is currently being reviewed by the Office of 
Management and Budget In connection with the Paper Reduction Act. Regarding the 
former, OHS is responsible for regulating the sate and transfer of ammonium nitrate. 6 
U.S.C. §§ 688-6081. DHS has issued a Notice of Proposed Rulemaking and currently is 
reviewing comments submitted in response to the notice. 76 Fed. Reg. 46,908 (Aug. 3, 

201 1 ) We will examine some of these issues as part of a new engagement dealing with 
DHS efforts to address mission-related issues. 
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Almost Half of ISCD’s 
Action Item Completion 
Dates Have Been Extended 
since April 2012 


Our analysis of the April and June versions of the plan shows that the 
division had extended the estimated completion dates for nearly half of 
the action items. Estimated completion dates for 52 percent (48 of 93 
items)^^ either did not change (37 items) or the date displayed in the June 
201 2 plan was earlier than the date in the April 201 2 version of the plan 
(1 1 items). Conversely, 48 percent (45 of 93) of the items in the June 
2012 version of the plan had estimated completion dates that had been 
extended beyond the date in the April 2012 plan. For example, in the April 
2012 plan, ISCD was to work with NPPD and IP on Identifying job skills, 
the correct job series, and job descriptions, action that was estimated to 
be completed in July 2012. However, the June 2012 plan shows that the 
completion date for this action item was extended to August 2012, more 
than 30 days beyond the date estimated in April 2012. Figure 4 shows the 
extent to which action plan items were completed earlier than planned, 
did not change, or were extended, from April 2012 through June 2012, for 
the human capital management, mission, and administrative issues 
identified in the plan. 


^^iSCD data show that 93 of 94 action items were consistent between the April 2012 and 
June 2012 action plans; therefore, computation of the estimated axnpletion dates is 
based on 93 total items. One action item in the ^ril 2012 plan dealing with strategies for 
managing ISCD funding levels was removed from the June 2012 plan because after the 
analysis was pr^ared and submitted to NPPD. the decision was made to delete the item 
from the plan The funding action item was r^laced in the June 2012 action plan with an 
action item to conduct a peer review of the facility tiering process and formula. For 
puiposes of this analysis, we use the 93 action items (instead of 94 action items) that 
were consistent between the April and June 2012 action plans. 
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Figure 4: Changes in CFATS Action Plans Estimated Completion Dates from April 2012 to June 2012 
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*ISCD data show that 93 of 94 action items were consistent between the April 2012 and June 2012 
action plans, therefore, computation of the estimated completion dates is based on 93 total items. 
One action item in the April 2012 plan dealing with strategies for managing ISCD funding levels was 
removed from the June 2012 plan because after the analysis was prepar^ and submitted to NPPD. 
the dedsion was made to delete the it^ from the plan. The Ending action item was replaced in the 
June 2012 plan with an action item to conduct a peer review of the ^cility tiering process and 
formula. For purposes of this analysis, we use the 93 action items that were consistent between the 
April and June 2012 action plans. 


ISCD ofTicials told us that estimated completion dates have been 
extended for various reasons. They said that one reason for moving these 
dates was that the work required to address some items was not fully 
defined when the plan was first developed and as the requirements were 
better defined, the estimated completion dates were revised and updated. 
In addition, ISCD officials also stated that timelines have been adversely 
affected for some action items because staff have been reassigned to 
work on higher-priority responsibilities, such as moving staff from their 
assigned duties to work on efforts to reduce the backlog of security plans 
under review. ISCD officials also told us that some dates have been 
extended because the division is awaiting actions within ISCD or by 
NPPD or IP. 
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Action Plan Performance 
Measures Could Help 
Gauge Progress 


ISCD. through its action plan, appears to be heading In the right direction 
toward addressing the challenges identified, but it is too early to tell if the 
action plan is having the desired effect because (1 ) the division has only 
recently completed some action items and continues to work on 
completing more than half of the others, some of which entail long-term 
changes, and (2) ISCD has not developed an approach for measuring the 
results of its efforts. ISCD officials told us that they had not yet begun to 
plan or develop any measures, metrics, or other documentation focused 
on measuring the impact of the action plan on overall CFATS 
implementation because they plan to wait until corrective action on all 
items has been completed before they can determine the impact of the 
plan on the CFATS program. For the near term, ISCD officials slated that 
they plan to assess at a high level the impact of the action plan on 
CFATS program implementation by comparing ISCD’s performance rates 
and metrics pre-action plan implementation and post-action plan 
implementation.^ However, because ISCD will not be completing some 
action items until 2014, it will be difficult for ISCD officials to obtain a 
complete understanding of the impact of the plan on the program using 
this comparison only. 


Now that ISCD has begun to take action to address the challenges 
identified, ISCD managers may be missing an opportunity to measure the 
effects or results of some of the actions taken thus far, particularly actions 
that are either in the early stages of implementation or are in the 
formative stages. Measuring results associated with particular action 
items would be consistent with Standards for Internal Control in the 
Federal Government, which calls for the establishment and review of 
performance measures and indicators to monitor activities and compare 
actual performance with planned or expected results throughout the 
organization and analyze significant differences. We recognize that it 
might not be practical to establish performance measures for all action 
items, for example: 1 of the 94 items calls for ISCD to initiate the hiring 
process for an economist. However, other action items may be 
candidates for performance measurement because they focus on 
organizational changes or mission-related issues. For example, once 
ISCD gels approval to move forward with a plan to reorganize, it could 


^^According to NPPD officials, ISCD uses performance measures to track the 
performance of the CFATS program overall, but as of June 2012 did not have 
performance measures in place to track the progress of the action plan, or particular 
action items. 
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develop interim plans and measures to monitor the progress of integrating 
various functions and use the information to identify barriers, if any, for 
completing this effort. Likewise, once ISCD makes the decision to revise 
its site security plan review process, it could develop measures for 
implementing those revisions and consider what measures might be 
appropriate for gauging its success in streamlining the process and 
completing security plan reviews. By looking for opportunities to develop 
performance measures covering the various action items and developing 
such measures, ISCD managers would be better positioned to identify 
any gaps in their efforts to address the challenges and have tools 
available to measure and monitor performance in the future. ISCD would 
also have a framework for providing continuity of operations when new 
managers or staff are hired, managers move from position to position, or 
as the program changes. Furthermore, ISCD would be better equipped to 
inform stakeholders of its progress as the organization moves toward 
resolving the challenges identified in the ISCD memorandum. 


ISCD Officials Stated 
That Almost Half of 
the Action Items 
Require Collaboration 
with or Action by 
NPPDorIP 


According to ISCD officials, almost half of the action items included in the 
June 2012 action plan either require ISCD to collaborate with NPPD and 
IP or require NPPD and IP to take action to address the challenges 
identified in the ISCD memorandum, NPPD, IP, and ISCD officials have 
been working together to identify solutions to the challenges the 
memorandum Identified and to close pertinent action items. 

One of the Issues identified in the ISCD memorandum was the level of 
NPPD and IP communication and support, According to ISCD officials, at 
the time the program was established, NPPD and IP communication and 
support were not adequate for the division to implement the CFATS 
program within the statutory time frames (which was 6 months following 
the passage of the CFATS statute). Regarding the ISCD memorandum 
and the action plan, NPPD, IP, and ISCD officials have been working 
together to identify solutions to these human capital and administrative 
challenges. According to division officials, 46 of the 94 action Items 
included in the June 2012 action plan require either action by NPPD and 
IP or collaboration with NPPD and IP. This includes collaborating with 
NPPD officials representing the NPPD human capital, facilities, and 
employee and labor relations offices, among others, and with IP’s 
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Directorate of Management Office.^’ As of June 2012, 13 of the 46 items 
that require action by or coliaboration with NPPD or IP are complete; 33 
of 46 are in progress. 

With regard to completed items, these focused largely on human capital 
and administrative issues. For example, 1 completed item required ISCD 
leaders to establish regular meetings with NPPD and IP human capital 
officials to ensure better communication and visibility on human capital 
issues. Our discussions with ISCD and NPPD officials confirmed that this 
action item was closed because meetings covering human capital issues 
have begun and are held on a weekly and recurring basis. NPPD, IP, and 
ISCD told us that one of the topics of discussion during the weekly 
meetings is the hiring of specialists so that the division has assurance 
that the CFATS reviews and inspection process properly include their 
expertise. According to these officials, hiring certain types of specialists is 
a difficult challenge given that ISCD is competing with other 
organizations, including organizations within DHS, for individuals that 
possess these specialized skills. These officials also stated that these 
weekly meetings provide NPPD, IP, and ISCD an opportunity to discuss 
human capital issues as they come up and ensure that the division’s 
hiring process runs smoothly. To further assist with ISCD's hiring efforts, 
IP officials said that one IP human capital staff member is moving to be 
co-located with the division with the intent that this co-located staff 
member will be an important accelerator to the hiring process and help 
keep ISCD hiring on track. Another related action item required similar 
meetings between ISCD and NPPD's Office of Employee and Labor 
Relations to discuss union-related issues. This item was closed because 
these NPPD staff members meet weekly with ISCD senior leaders to 
discuss how the union operates and how they should work with the union, 
and help them understand and properly address the division's obligations 
to the union. 

With regard to the 33 of 46 actions items requiring collaboration with 
NPPD and IP that are in progress, 23 require NPPD or IP to review and 
approve work completed by ISCD or make policy decisions before the 
division can list the action item as complete. For example, 


IP Directorate of Management Office is responsible for providing IP divisions with 
program management support such as training and facilities management. 
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• Twelve of the 33 action items involve ISCD's development of the 
aforementioned realignment plan. As of June 2012, ISCD had 
forwarded the realignment plan to NPPD and IP for review and was 
awaiting approval so that the plan could be fonvarded to DHS for 
review and comment. 

• Another action item requires ISCD to develop a human capital 
strategic plan. According to the June 2012 action plan, ISCD is 
waiting for NPPD to release its Human Capital Strategic Plan to 
finalize this action item and plans to use the guidance provided in the 
NPPD plan to develop an ISCD Strategic Human Capital Plan. 

ISCD continues to work on the remaining 10 of the 33 in-progress action 
items that require NPPD or IP action or division collaboration with NPPD 
and IP. According to the June 2012 action plan, completion of these 
action items is dependent upon ISCD staff completing an internal review 
of an ISCD-drafted set of standard operating procedures or 
memorandum, or an analysis of an existing ISCD procedure. Once ISCD 
finalizes these 10 action items, the outputs are to be forwarded to NPPD 
and IP for review, comment, and approval, where appropriate. 

Additional details on action items that require collaboration with or action 
by NPPD or IP are considered “for official use only.” 


Conclusions 


ISCD has identified numerous challenges it has encountered 
implementing the CFATS program and has developed an action plan that 
is intended to help address these challenges. This appears to be a step in 
the right direction as officials continue their efforts to better manage the 
program and establish a viable process consistent with the statute and 
the CFATS rule. Because of the scope and breadth of the action plan and 
given that that many of the action items were recently completed (38 of 
94 action items) or are in progress (56 of 94 action items), it is too early to 
tell whether they will have the effect of helping ISCD overcome and 
resolve all the problems it has identified. However, ISCD, working with 
NPPD and IP, may be better positioned to understand and report on Its 
progress by looking for opportunities to measure the effect of efforts to 
implement key action items, especially since many of the action items are 
either recently completed or in their formative stages. By developing 
performance measures, where practical, ISCD, IP, and NPPD would be 
better equipped to identify any gaps between actual and planned or 
expected results and take corrective action, where necessary, consistent 
with Standards for Internal Control in the Federal Government 
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Furthermore, ISCD, IP, and NPPD would be better positioned to report on 
their progress developing a viable CFATS program to key stakeholders, 
including Congress. 

Recommendation for 
Executive Action 

To better ensure that DHS can better understand the effect of its actions 
as it moves forward with its efforts to address the challenges facing ISCD 
as it implements the CFATS program, we recommend that the Secretary 
of Homeland Security direct the Under Secretary for NPPD, the Assistant 
Secretary for IP, and the Director of ISCD, in conjunction with the 
development of ISCD’s strategic plan, to look for opportunities, where 
practical, to measure results of their efforts to implement particular action 
Items, and where performance measures can be developed, periodically 
monitor these measures and indicators to identify where corrective 
actions, if any, are needed. 

Agency Comments 
and our Evaluation 

We provided a draft of this statement to the Secretary of Homeland 
Security for review and comment. The Deputy Under Secretary for NPPD 
and the Assistant Secretary for Infrastructure Protection provided oral 
comments on July 23, 2012, and stated that NPPD agreed with our 
recommendation. NPPD officials said that they intend to provide an 
updated action plan that includes a new action item to “develop metrics 
for measuring, where practical, results of efforts to implement action plan 
items, including processes for periodic monitoring and indicators for 
corrective actions.' The Deputy Under Secretary also noted that these 
new measures would be in addition to the program metrics NPPD uses to 
measure the overall progress of the CFATS program. 


DHS also provided technical comments, which we incorporated as 
appropriate. 


As agreed with your offices, we will continue to review the CFATS 
program and review ISCD’s efforts to manage the mission aspects of the 
program. This will include ISCD efforts to determine chemical facility risk; 
manage the process used to assess vulnerabilities, review security plans, 
and perform inspections: and work with owners and operators of high-risk 
chemical facilities. We expect to report the results of these efforts early in 
2013. 
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Chairman Aderholt, Ranking Member Price, and members of the 
subcommittee, this completes my prepared statement, I would be happy 
to respond to any questions you may have at this time. 
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Appendix I: Objectives, Scope and 
Methodology 


This statement discusses how the internal Infrastructure Security 
Compliance Division's (ISCD) memorandum (the ISCD memorandum) 
was developed and what challenges were identified, what actions are 
being taken to address the challenges identified, and the extent to which 
ISCD’s planned actions and proposed solutions require collaboration with 
National Protection and Programs Directorate (NPPD) or the Office of 
Infrastructure Protection (IP). 

To determine how the ISCD memorandum was developed and the 
challenges outlined in the memorandum, we reviewed and analyzed the 
memorandum to determine the various Chemical Facility Anti-Terrorism 
Standards (CFATS) program challenges as identified by the 
memorandum's author— i.e., the ISCD Director, who was the primary 
author, in consultation with the Deputy Director. As a part of our analysis, 
we grouped the challenges into overarching categories— human capital 
management issues, mission issues, and administrative issues — and 
used the sub-categories developed by the author of the ISCD 
memorandum to summarize the types of challenges or problems 
described in the ISCD memorandum. We also inten/iewed 14 ISCD 
senior officials (including the ISCD Director and Deputy Director) to 
confirm our understanding of the challenges identified, determine how the 
memorandum was developed, and obtain ISCD officials' views on what 
may have created the CFATS program challenges. 

To determine what actions ISCD is taking to address the challenges 
identified in the memorandum, we analyzed and compared the various 
action plans that were prepared by ISCD senior officials between January 
2012 and June 2012. We developed a list of the 94 action items included 
in the June plan and determined the status of each action item 
(completed or in progress), the extent to which the ISCD officials 
responsible for leading efforts for the action item agreed that the action 
item addressed an existing problem, and the extent to which the activities 
related to the action item were in progress prior to the ISCD 
memorandum’s release. Where possible, we obtained and reviewed 
documentation (e.g., standard operating procedures and ISCD memos) 
relevant to each action item to support ISCD officials' views that the 
status of the action item was accurate and whether the work on the action 
item was in progress before the development and release of the ISCD 
memorandum. We also compared the results of our analysis of the action 
plans and our discussions with program officials with various criteria, 
including the CFATS law and regulations; Department of Homeland 
Security (DHS) policies, procedures, and reports; Standards for Internal 
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Appendix I: Objectives, Scope and 
Methodology 


Control in the Federal Government; ' and The Standard for Program 
Management.^ 

To determine the extent to which jSCD's planned actions and proposed 
solutions require collaboration with or action by NPPD or IP officials, we 
interviewed 11 NPPD and 9 IP officials identified by ISCD officials who 
are to work with ISCD to implement corrective actions. Using the results 
of these interviews and our analysis of the ISCD memorandum and action 
plan, we determined the extent to which collaboration among ISCD, 
NPPD, and IP is required to implement corrective action, if at all. Where 
available, we obtained and reviewed NPPD, IP. and ISCD documentation 
(e.g., policies, standard operating procedures, and Internal memos) 
relevant to each action item that requires NPPD or IP support or action in 
working with ISCD to overcome those challenges. 

We identified three limitations that should be considered when using our 
results. First. ISCD’s memorandum is largely based on the efforts of the 
ISCD Director in consultation with the ISCD Deputy Director and may not 
be representative of the views of other senior officials within the CFATS 
program. Furthermore, the conclusions reached in the memorandum 
were not obtained by using a formal compliance audit or program review 
procedures, nor were the assumptions validated. Second, our results are 
based on the status of the action plan as of June 2012, so these results 
are valid only up until this point in time. Third, documentary evidence 
about the development of the CFATS program and the causes for the 
issues identified in the ISCD memorandum is, for the most part, not 
available. Program officials did not maintain records of key decisions and 


^GAO, Standards for Internal Control in the Federal Government, GAO/AIMD 00-21.3.1 
(Washington, D.C.: November 1^9). Internal control is an integral component of an 
organization's management that provides reasonable assurance that the following 
objectives are being achieved; effectiveness and efficiency of operations, reliability of 
ftnanctal reporting, and compliance with applicable laws and regulations. These standards, 
issued pursuant to the requirements of the Federal Managers' Financial Integrity Act of 
1982 (FMFIA). provide the overall framework for establishing and maintaining internal 
control in the federal government. Also pursuant to FMFIA, the Office of Management and 
Budget issued Circular A-123, revised December 21 , 2004, to provide the specific 
requirements for assessing the reporting on interna! controls. Internal control standards 
and the definition of internal control in Circular A-123 are based on GAO’s Standards for 
Internal Control in the Federal Government. 

^Project Management Institute, The Standard for Program Management© (Newtown 
Square, Pa; 2006).The Standard for Program Management provides guidelines for 
successfiilly managing programs and projects. 
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Appendix i: Ob|ectlvas, Scope and 
Mettiodoiogy 


the basis for those decisions during the early years of the program. 

During preliminary discussions, the members of current management 
team qualified that much of their knowledge about program decisions 
during the early years of the program is their best guess of what 
happened and why. 

We conducted this performance audit from February 2012 to July 2012 In 
accordance with generally accepted government auditing standards. 
Those standards require that we plan and perform the audit to obtain 
sufficient, appropriate evidence to provide a reasonable basis for our 
findings and conclusions based on our audit objectives. We believe that 
the evidence obtained provides a reasonable basis for our analysis based 
on our audit objectives. 
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Appendix II: ISCD Organizational Structure 
within NPPD and IP as of June 2012 


This appendix provides the organizationai structure used to manage the 
Chemicai Facility Anti-Terrorism Standards program within the 
Infrastructure Security Compliance Division. ISCD has direct 
responsibility for implementing DHS’s CFATS rule, including assessing 
high-risk chemical facilities, promoting collaborative security planning, 
and ensuring that covered facilities meet DHS’s risk-based performance 
standards.’ ISCD is managed by a Director and a Deputy Director and 
operates five branches that are, among other things, responsible for 
information technology operations; policy and planning; providing 
compliance and technical support; inspecting facilities and enforcing 
CFATS regulatory standards; and managing logistics, administration, and 
chemical security training. ISCD receives business support from the 
National Protection and Programs Directorate and the Office of 
infrastructure Protection for services related to human capital 
management and training, budget and finance, and acquisitions and 
procurement. Figure 5 shows the organizational structure of NPPD, IP, 
and ISCD. 


’The CFATS rule establishes 18 risk-based performance standards that identify the areas 
for which 3 facility’s security plan is to be examined, such as perimeter security, access 
control, and cyber secunty. To meet these standards, facilities are free to choose 
whatever security programs or processes they deem appropriate so tong as OHS 
determines that they achieve the requisite level of performance in each of the applicable 
areas. 
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Appendix il: ISCD Or^anizattonal Structure 
within NPPD and iP as of June 2012 


Figure 5: iSCD Organizational Structure wittiin NPPD and IP as of June 2012 
National Protection & Programs Directorate (NPPD) 



Office of Infrastructure Protection (IP) 
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Appendix III: Summary of ISCD Action Plan 
by Issue and Subcategory, and Status 


This appendix provides a summary of the status and progress of action 
items grouped by issue and sub-category. The Infrastructure Security 
Compliance Division is using an action plan to track its progress in 
addressing the challenges identified in the November 201 1 iSCD 
memorandum prepared by the ISCD Director in consultation with the 
Deputy Director. The ISCD memorandum was accompanied by an action 
plan that, according to the authors of the memorandum, was Intended to 
provide solutions to addressing the challenges identified. Table 1 
provides an overview of the items in the action plan and their status 
(completed or in progress) by issue (human capital management, mission 
issues, and administrative issues) and subcategory. 


Table 1: Summary of ISCD Action Items by Overarching issues and Subcategory and Status, June 2012 

Issue 

Sub-category 

Overview of action items 

Number of 
action items 
in progress 

Number of 
action items 
complete 

Total 
number of 
action items 

Human capital 
management 



-.13 

■ ~ n 

. ,30 


Culture 

Action Items in this category are interKted to 
improve overall communication within the division 
between staff and management, develop 
procedures for addressing conduct and disapline 
issues, and enhance employee awareness about 
policies and procedures to address conduct and 
discipline. 

1 

10 

11 


Performance 

Action items in this category are intended to 
assist in the development of iSCO’s performance 
management procedures and training and to 
ensure DHS. NPPO, and IP performance policies 
and procedures are communicated to ail 
employees. 

2 

1 

3 


Staffing 

Action items in this category are intended to 
address iSCO's efforts to conduct an 
organizational realignment of staff; hire 
employees to fill skill and experience gaps, 
upgrade employee skills consistent with iSCD’s 
mission; and train employees in conduct, 
discipline, and performance issues. 

10 

3 

13 


Union 

Action items in this category are intended to 
focus on ISCD s efforts to address union-related 
issues, including efforts to coordinate with the 
union on employee and labor issues. 

0 

3 

3 
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^pendix lit: Summary of iSCD Action Plan by 

Issue and Subcategoiy, and Status 

Issue Sub-category 

Overview of action Items 

Number of 
action items 

In progress 

Number of 
action items 
complete 

Total 
number of 
action items 

Mission 


Action items in this category are intended to 
address issues associated with the CFATS 
program core mission activities, including efforts 
to streamline the site seairity plan review 
process and develop processes and procedures 
for conducting insfi^ctions at tiered taciiities. 

16 

6 

22 

Administrative , 


2r 

.15 

42 

Contracting 

Adion items in this category are intended to 
address concerns about ISCO’s reliance on 
contractors to support mission-essential activities 
and assess whether inherency governmentaj 
activities are being performed by contractors. 

3 

4 

7 

Documentation 

Action items in this category are intended to 
focus on the development of a human capital 
strategic plan, and address deficiencies in ISCD's 
records management system and various 
administrative policies and procedures. 

11 

5 

16 

Human 

resources 

Action items in this category address iSCD, IP, 
and NPPD communications and collaboration 
regarding human capital issues, such as hiring 
qualified staff and employee and labor relations, 
and ISCD's efforts to reassign personnel to better 
achieve CFATS mission goals. 

5 

4 

9 

Inspector 

Action items m this category are intended to 
address concerns about vehicle use. 
administratively uncontrollable overtime, and 
other administrative issues pertaining to CFATS 
inspectors. 

3 

2 

5 

Miscellaneous 

Action items in this category are intended to 
focus on ISCD’s organizational alignment, clarify 
functions within the organization, and equipment 
requirements for CFATS Insper^ors. 

3 

0 

3 

Property 

management 

This action item is intended to focus on ISCD's 
reduced requirement for dassified space. 

1 

0 

1 

Real estate 

This action item is intended to focus on ISCD's 
field operation space requirements. 

1 

0 

1 

Total 


56 

38 

94 


Source GAOanalysiso) June 2012 ISQ> action plan prepared by iSCD oflicials 
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Opening Statement: Deputy Under Secretary Spaulding 

Mr. Aderholt. Secretary Spaulding. 

Ms. Spaulding. I very much appreciate the opportunity to ap- 
pear here today to discuss the Department of Homeland Security’s 
efforts to regulate the security of high risk chemical facilities under 
the Chemical Facility Anti-Terrorism Standards, or CFATS. I 
would also like to thank GAO for its efforts in reviewing the 
progress that we have made in implementing the action plan devel- 
oped by our CFATS leadership to address the challenges that GAO 
identified last fall. 

The department concurs with the single recommendation made 
by GAO, that we develop performance measures where appropriate 
and practical and that can help us assess the impact of the action 
plan on the overall implementation of the CFATS program. We in- 
cluded the GAO’s recommendation as the 95th item on our action 
plan. I understand that GAO is now beginning a broader audit of 
the CFATS program and we stand ready to support that effort. 

Let me state at the outset that CFATS has made America safer. 
Since the inception of CFATS more than 1,800 facilities completely 
removed their chemicals of interest, and more than 900 other facili- 
ties have reduced their holdings of chemicals of interest below the 
high risk threshold. In addition, for the first time we now have in- 
formation about chemical holdings of more than 41,000 facilities 
across the nation. Seven thousand eight hundred facilities deter- 
mined to be potentially high risk have now assessed their 
vulnerabilities to terrorist attack and more than 3,500 have devel- 
oped and submitted for DHS review detailed security plans based 
on performance-based standards that were developed under this 
program enacted by Congress. This amounts to real progress to- 
ward a safer America. 

My testimony today addresses the current status of the program, 
with a particular focus on the implementation of the action plan. 
Although the numbers alone do not tell the story of our progress, 
I am pleased to inform you that the department has completed 59 
of the 95 action items included in the action plan. This is signifi- 
cantly higher than the number reported by the GAO in its testi- 
mony because, of course, the department has continued to work on 
completing the action items following the conclusion of the GAO 
audit last month. 

For accountability, planning, and tracking purposes the CFATS 
leadership team has established milestones for the completion of 
each action item and timelines for each task within that item. 
Some of the original completion dates for a few of the items have 
been modified as we have moved through implementation. I can 
say with confidence that substantial progress has been made on 
each and every action item. 

As of July 20 , CFATS covers 4,425 high risk facilities, nearly 
3,700 of which have received final high risk tier determinations. 
And I want to note here that, although we use the term final, it 
is important to remember that tiering is a dynamic process. DHS 
will continue to issue final tier notifications and where appropriate 
revise those tier determinations as facilities make changes to their 
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operations that affect their risk levels and as DHS continues to re- 
fine and improve its risk assessment methodology. 

I would like to share with the subcommittee some of the high- 
lights and successes that are a direct result of the implementation 
of the action plan and other recent initiatives by the division that 
manages CFATS, the Infrastructure Security Compliance Division 
or ISCD. We have improved the security plan review process, 
which has significantly increased the pace of those reviews. We 
have refined the inspector tools and training and last week we re- 
started authorization inspections. We also continue to work with 
industry on industry’s development of alternative security pro- 
grams and it is my understanding that the American Chemistry 
Association will soon be sharing its template with its members. In 
addition, ISCD has nearly completed its internal review of tiering 
methodology and we are about to kick off the external peer review. 

The CFATS leadership has made tremendous progress also in 
improving internal communications and organizational culture. We 
continue to work with industry and our federal, state, and local 
partners to meet our challenges, implement this program, and help 
prevent terrorists from exploiting our nation’s chemical assets in 
order to harm our citizens and our country. We recognize and are 
grateful for the significant work of this subcommittee to reauthor- 
ize the CFATS program and we urge Congress to establish a per- 
manent authority for the CFATS program in federal law. 

Mr. Chairman, as we have previously discussed, David Wulf, who 
has served as ISCD Deputy Director, permanently assumed the 
role of ISCD Director on July 23. Director Wulf has worked closely 
with our former Director Penny Anderson during her tenure and 
he will provide valuable continuity in leadership. His experience, 
expertise, and judgment have been instrumental in the program’s 
progress to date, and Director Wulf has my full confidence in mov- 
ing CFATS forward. 

Before I close I want to apologize to the committee for not getting 
the notification up to you before withdrawing our ICR on personnel 
surety. It was certainly our intention to notify you in a timely way. 
We wanted to move quickly in order to have this done before the 
hearing so that we could discuss it. We look forward to moving for- 
ward quickly on refiling our personal surety information collection 
request (ICR) after having the kind of candid and granular discus- 
sions with both the Hill and with our stakeholders across the board 
that the previous process did not really permit it to do. Withdrawal 
is, in our view, the most expeditious way to get to a personnel sur- 
ety program, which we all can support. 

In closing, Mr. Chairman, I want to emphasize that ISCD, 
NPPD, and the department are moving forward quickly and strate- 
gically to address the challenges before us. We firmly believe that 
CFATS is making the nation safer and we are dedicated to its suc- 
cess. As we implement CFATS we will continue to work with stake- 
holders to get the job done, meet the challenges, and execute a pro- 
gram to help prevent terrorists from exploiting chemicals or chem- 
ical facilities. 

Thank you for holding this important hearing and I look forward 
to your questions. 

[The information follows:] 
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Thank you, Chairman Aderholt, Ranking Member Price, and distinguished Members of the 
Subcommittee. It is a pleasure to appear before you today to discuss the Department of 
Homeland Security's (DHS) efforts to regulate the security of high-risk chemical facilities under 
the Chemical Facility Anti-Terrorism Standards (CFATS). 

As you are aware, the Department's current statutory authority to implement CFATS - Section 
550 of the Fiscal Year (FY) 2007 Department of Homeland Security Appropriations Act, as 
amended - has been extended through October 4, 2012. The CFATS program has made our 
Nation more secure and DHS welcomes the opportunity to continue to work with Congress, all 
levels of government, and the private sector to further improve this vital national security 
program. 

CFATS has helped to make our country safer. Since the inception of CFATS, more than 1,800 
facilities have completely removed their chemicals of interest, and more than 900 other facilities 
have reduced their holdings of chemicals of interest to levels resulting in the facilities no longer 
being considered high-risk. These actions have helped to reduce the number of high-risk 
chemical facilities located throughout the Nation and have enabled facilities to take actions that 
minimize their requirements under CFATS. 

In the interest of building upon our collaboration, my testimony today focuses on the current 
status of the program, examples of the program’s successes to date, some of the current 
challenges facing the National Protection and Programs Directorate (NPPD) in implementing 
CFATS, and the actions we are taking to address these challenges through the Infrastructure 
Security Compliance Division (ISCD) Action Plan. Progress has been made on all of the Action 
Plan action items that remain open, and I would be glad to discuss both the progress made by the 
Department on these action items as well as the path forward the Department has charted for 
completing these items. Equally as important, 1 will reiterate the principles that we believe 
should guide the program's maturation and continued authorization. 

I am pleased to inform you that the Department has completed 53 of the 94 action items included 
in the Action Plan. It should be noted that this is significantly higher than the number reported 
by the Government Accountability Office (GAO) in its report, as the Department continues to 
work on and complete action items following the conclusion of the GAO audit. I also would like 
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to thank GAO for its efforts in reviewing the CFATS program. We have made progress in 
addressing identified challenges, but more remains to be done. 

At Under Secretary Beers’ direction, the program’s leadership has outlined its priorities, the 
challenges it believes the program faces, and a proposed path forward to address those 
challenges and accomplish program objectives. NPPD, the Directorate with oversight 
responsibility for the CFATS program, is continuously reviewing the program to identify areas 
for improvement and correcting course when necessary to ensure proper implementation. 


Chemical Facility Security Regulations 

Section 550 of the FY 2007 Department of Homeland Security Appropriations Act directed the 
Department to develop and adopt within six months a regulatory framework to address the 
security of chemical facilities that the Department determines pose high levels of risk. 
Specifically, Section 550(a) of the Act authorized the Department to adopt regulatory 
requirements for high-risk chemical facilities to complete Security Vulnerability Assessments, or 
SVAs, develop Site Security Plans, or SSPs, and implement protective measures necessary to 
meet risk-based performance standards established by the Department. Consequently, the 
Department published an Interim Final Rule, known as CFATS, on April 9, 2007. Section 550, 
however, expressly exempts from the regulation certain facilities that are regulated under other 
federal statutes, specifically those regulated by the United States Coast Guard pursuant to the 
Maritime Transportation Security Act, drinking water and wastewater treatment facilities as 
defined by Section 1401 of the Safe Water Drinking Act and Section 212 of the Federal Water 
Pollution Control Act, and facilities owned or operated by the Departments of Defense or 
Energy, as well as certain facilities subject to regulation by the Nuclear Regulatory Commission, 
orNRC. 

The following core principles guided the development of the CFATS regulatory structure: 

1 . Securing high-risk chemical facilities is a comprehensive undertaking that involves a 
national effort, including all levels of government and the private sector. Integrated and 
effective participation by all stakeholders — federal, state, local, tribal, and territorial 
government partners, as well as the private sector — is essential to securing our critical 
infrastructure, including high-risk chemical facilities. 

2. Risk-based tiering is used to guide resource allocations . ' Not all facilities present the 
same level of risk. The greatest level of scrutiny should be focused on those facilities 
that present the highest risk those that, if targeted, would endanger the greatest number 
of lives. 


Tiering determinations are dynamic) for example, a tiering determination can change when a company voluntarily alters its facilities in a way 
that reduces its risk profile. "Final tiering’ refers to a tiering assignrnent following a Security Vulnerability Assessment— it does not imply that 
this is the final tiering assignment a facility may ever receive. 
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3. Reasonable, clear, and calibrated performance standards will lead to enhanced security. 
The CFATS rule establishes enforceable risk-based performance standards, or RBPS, for 
the security of our Nation’s chemical facilities. High-risk facilities have the flexibility to 
develop appropriate site-specific security measures that will address risk effectively by 
meeting these standards, ISCD will analyze all final high-risk facility SSPs to ensure that 
they meet the applicable RBPS and will approve those that do. If necessary, ISCD will 
work with a facility to revise and resubmit an acceptable plan and can disapprove security 
plans if an acceptable plan is not submitted. 

4. Recognition of the progress many companies have already made in improving facility 
security leverages those advancements. Many companies made significant capital 
investments in security following 9/11, and even more have done so since the passage of 
the legislation establishing this program. 


Rule Implementation 

On November 20, 2007, the Department published CFATS’ Appendix A, which lists 322 
chemicals of interest — including common industrial chemicals such as chlorine, propane, and 
anhydrous ammonia — as well as specialty chemicals, such as arsine and phosphorus trichloride. 
The Department included chemicals based on the potential consequences associated with one or 
more of the following three security issues: 

1 . Release - Toxic, flammable, or explosive chemicals that have the potential to create 
significant adverse consequences for human life or health if intentionally released or 
detonated 

2. Theft/Diversion - Chemicals that have the potential, if stolen or diverted, to be used as or 
converted into weapons that could cause significant adverse consequences for human life 
or health 

3. Sabotage/Contamination - Chemicals that are shipped and that, if mixed with other 
readily available materials, have the potential to create significant adverse consequences 
for human life or health 

The Department also established a Screening Threshold Quantity for each chemical of interest 
based on its potential to create significant adverse eonsequences to human life or health in one or 
more of these ways. Any chemical facility that possesses any chemical of interest at or above the 
applicable Screening Threshold Quantity must submit an initial consequence-based screening 
tool, commonly referred to as the “Top-Screen,” to DHS. Through the Top-Screen process, 

ISCD identifies high-risk facilities, which the Department then assigns to one of four preliminary 
risk-based tiers, with Tier 1 representing the highest level of potential risk. 

Implementation of the CFATS regulation requires the Department to identify which facilities it 
considers high-risk. Supporting this, ISCD developed the Chemical Security Assessment Tool, 
or CSAT to help the Department identify potentially high-risk facilities and to provide 
methodologies that those facilities can use to conduct SVAs and to develop SSPs. CSAT is a 
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suite of online applications designed to facilitate compliance with the program. It includes user 
registration, the Top-Screen, an SVA tool, and an SSP template. The CSAT tool is a secure tool 
that can be accessed only by Chemical-terrorism Vulnerability Information authorized users. 

In May 2009, DHS issued Risk-Based Performance Standards Guidance to assist final high-risk 
chemical facilities in determining appropriate protective measures and practices to satisfy the 
RBPS. It is designed to help facilities comply with CFATS by providing detailed descriptions of 
the 1 8 RBPS as well as examples of various security measures and practices that could enable 
facilities to achieve the appropriate level of performance for the RBPS at each tier level. The 
Guidance was informed by the experience of the Transportation Security Administration, United 
States Coast Guard, and the Environmental Protection Agency, and also reflects public and 
private sector dialogue on the RBPS and industrial security, including public comments on the 
draft guidance document. High-risk facilities are free to make use of whichever security 
programs or processes they choose — whether or not in the Guidance — provided that DHS 
determines through approval of the facilities’ SSPs that they achieve the requisite level of 
performance under the CFATS RBPS. 

Implementation Status 

To date, ISCD has received more than 41,000 Top-Screens submitted by chemical facilities. 

Since June 2008, ISCD has notified more than 7,800 facilities that it has initially designated 
them as high-risk and that thus, they are required to submit SVAs. ISCD has completed its 
review of approximately 7,800 submitted SVAs. In May 2009, following reviews of facilities’ 
SVA submissions, ISCD began notifying facilities of their final high-risk determinations, risk- 
based tiering assignments, and the requirement to complete and submit an SSP or an Alternative 
Security Program, or ASP, in lieu of an SSP. 

As of July 20, 2012, CFATS covers 4,425 high-risk facilities nationwide; of these 4,425 
facilities, 3,662 are currently subject to final high-risk determinations and submission of an SSP 
or ASP. The remaining facilities are awaiting final tier determinations based on their SVA 
submissions. ISCD continues to issue final tier notifications to facilities across all four risk tiers 
as it makes additional final tier determinations. 

Outreach Efforts 

Since the establishment of CFATS in April 2007, NPPD and ISCD have taken significant steps 
to publicize the rule and ensure that the regulated commtmity and other interested or affected 
entities are aware of its requirements. NPPD and ISCD management and staff have presented at 
hundreds of security and chemical industry conferences and participated in a variety of other 
meetings. As part of this outreach program, NPPD and ISCD has regularly updated impacted 
sectors through their Sector Coordinating Councils and the Government Coordinating 
Councils — including the Chemical, Oil and Natural Gas, and Food and Agriculture Sectors. In 
addition, ISCD continues to focus on fostering solid working relationships with state and local 
officials, including first responders. 


NPPD and ISCD continue to collaborate within DHS and with other federal agencies in the area 
of chemical security, including routine engagement among with the USCG; the Transportation 
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Security Administration; the Department of Justice's Federal Bureau of Investigation and Bureau 
of Alcohol, Tobacco, Firearms and Explosives; the NRC; and the Environmental Protection 
Agency. 

Across the Nation, BCD’s Chemical Security Inspectors have been actively working with 
facilities and governmental agencies. Collectively, they have participated in more than 3,800 
meetings with federal, state, and local officials, conducted more than 1,050 Compliance 
Assistance Visits, and have held more than 4,160 informal introductory meetings with owners 
and/or operators of CFATS-regulated facilities. 

To promote information sharing, BCD has developed several communication tools for 
stakeholder use, including: the Chemical Security website (www.DHS.gov/chemicalsecuritv l: a 
Help Desk for CFATS-related questions; a CFATS tip-line for anonymous chemical security 
reporting; and CFATS-Share, a web-based information-sharing portal that provides certain 
Federal, state, and local agencies access to key details on CFATS facility information as needed. 

Highlights and Successes of CFATS Program 

As we have previously discussed, the Action Plan currently contains 94 items, each of which has 
been assigned to a member of BCD’s senior leadership team for implementation. As of July 20 
2012, 53 of the 94 action items contained in the Action Plan have been completed. For 
accountability, planning, and tracking purposes, the members of that leadership team have 
established milestones and a schedule for the completion of each task assigned to them, In 
addition, BCD leadership meets with me at least once per week to provide status updates on the 
action items and discuss ways that NPPD leadership can help. 

I would like to share with the Subcommittee some of the highlights and successes that are a 
direct result of the implementation of the Action Plan and other recent initiatives performed by 
BCD. These include: improving the SSP review process and increasing the pace of SSP 
reviews; refining inspector tools and training; reinvigorating industry engagement on their 
development of ASP templates; improving internal communications and organizational culture; 
and preparing for an external peer review of the CFATS risk assessment methodology. 

SSP Review Process. BCD is currently utilizing an interim SSP review process to enable 
BCD to move forward with SSP reviews in a consistent, reasonable, and timely fashion. At this 
time, BCD has completed its initial review of all Tier 1 SSPs and has begun reviewing Tier 2 
SSPs. As of July 16, 2012, of theTier 1 SSPs reviewed, the Department has authorized or 
conditionally authorized SSPs for 63 facilities. Of the remaining Tier 1 SSPs reviewed by the 
Department, we are either validating results or reaching out to these facilities to obtain additional 
information or action in the hope of resolving the outstanding issues affecting their SSPs. While 
the interim approach for SSP reviews is underway, BCD will continue to work to improve the 
long-term approach to the SSP review process. 

Inspections. In September 2011, BCD established an Inspector Tools Working Group to ensure 
the Chemical Security Inspectors have up-to-date and, where appropriate, improved inspections 
procedures, policies, equipment, and guidance. In June 2012, BCD finished updating its internal 
inspections policy and guidance materials for inspectors. BCD also began providing additional 
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training that focuses on the updated policy and guidance materials to prepare Chemical Security 
Inspectors to resume authorization inspections at facilities with authorized or conditionally 
authorized SSPs. As a result, I am pleased to announce that as of July 16, 2012, ISCD has 
resumed authorization inspections at Tier 1 facilities. This is a vital step for moving the CFATS 
program toward a regular cycle of approving SSPs and conducting compliance inspections for 
facilities with approved SSPs. 

Alternative Security Programs. Many members of the regulated community and then- 
representative industry associations have expressed interest in exploring ways to use the ASP 
provisions of the CFATS regulation to streamline the security plan submission and review 
process. In support of this, ISCD has been holding vigorous discussions with industry 
stakeholders in regard to their development and submission of ASPs. One particularly promising 
effort has been ISCD’s engagement with the American Chemistry Council, or ACC, in support 
of its efforts to develop an ASP template for use by interested members of its organization. It is 
our understanding that the ACC plans to pilot its ASP template later this year. ASPs submitted 
by facilities using the ACC template will be reviewed under the same standards that ISCD 
currently reviews SSPs, but the use of ASP templates may streamline both the plan development 
and plan review processes. Additionally, DHS continues to review existing industry programs, 
such as ACC Responsible Care® and SOCMA ChemStewards®, to identify potential areas of 
engagement and further discussion. 

Internal Communications and Employee Morale. The Action Plan contains a number of 
items designed to improve internal communications and morale within ISCD. ISCD has 
implemented many of these action items and has made significant progress on many others, For 
instance, ISCD employees now contribute to and receive a monthly ISCD newsletter, which 
covers a wide variety of both field and headquarters activities. ISCD leadership has promoted 
staff engagement and a dialogue about issues and concerns through monthly town halls and a 
senior leadership open-door policy. ISCD staff has a standing invitation to participate in group 
open-door sessions or to schedule one-on-one discussions with Division leadership. 

ISCD also is moving forward with issuing vacancy announcements to hire a permanent 
leadership team; several announcements have already been posted and several others are nearing 
posting. Supervisors have been provided with additional supervisory training and guidance on 
performance monitoring. The Division has developed a mission statement, vision statement, and 
core values. As a result of these and other efforts, I believe that Division-wide morale is 
improving, which ultimately will pay dividends not only in improved staff retention, but also in 
improved staff performance and program execution. 

Risk Assessment Methodology Review. In light of prior revisions to the SVA risk assessment 
computer program for chemical facilities, NPPD has committed to doing a thorough review of 
the risk assessment process and keeping the Subcommittee apprised of any significant issues 
related to that review. In support of this, NPPD developed a three-phased approach, which is 
captured in the Action Plan and includes: documenting all processes and procedures relating to 
the risk assessment methodology; conducting an internal DHS review of the risk assessment 
process; and initiating an external peer review of the risk assessment methodology. The 
Division has made significant progress on this action item by completing the first two steps. 
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ISCD is also approaching completion of procurement actions for the external peer review, which 
is expected to begin before the end of FY12, 

NPPD remains committed to both developing appropriate responses to any risk assessment issues 
that it identifies and keeping Congress and stakeholders apprised of any significant issues related 
to that review. 

ISCD Budget Priorities for FY13 

The President’s Budget for FY 2013 requested $74,544 million for the Infrastructure Security 
Compliance Program, including funds for 253 full-time positions/242 full-time equivalents, or 
FTE. The primary initiatives under Infrastructure Security Compliance are the implementation 
of the CFATS Program and the development and implementation of the proposed Ammonium 
Nitrate Security Program. In helping to develop the President’s Budget, DHS considered as one 
of its top priorities the retention of basic CFATS ftmctionality. Accordingly, DHS prioritized its 
funding request to enable DHS to thoroughly and expediently review SSPs of CFATS-covered 
facilities that pose the highest level of risk to ensure that such facilities’ security measures meet 
applicable risk-based performance standards and to expedite the perfoimance of inspections at 
those facilities. 

The FY 2013 DHS Appropriations bill that was approved by this Subcommittee would provide 
$45.4 million for the Infrastructure Security Compliance Program. This represents a decrease of 
$47,908 million from the FY 2012 enacted level of $93,348 million, and is $29.1 million less 
than the President’s Budget request. 

An appropriation of $45.4 million would drastically curtail DHS’s ability to: 1) implement the 
statutory and regulatory requirements for the security of high-risk chemical facilities as specified 
in CFATS; 2) continue development of the proposed Ammonium Nitrate Security Program; and 
3) fully implement the program improvements identified in the ISCD Action Plan. DHS 
estimates that, after expending approximately $35 million for salaries and benefits for 242 FTEs, 
approximately $12 million would remain for implementing CFATS and completing development 
of the proposed Ammonium Nitrate Security Program. DHS would be forced to cease virtually 
all activities under CFATS other than those directly related to reviewing SSPs and performing 
facility inspections — which means those other activities would be significantly delayed. At the 
proposed $45.4 million funding level, the Department’s ability to conduct the most basic CFATS 
functions would be impacted. These include maintaining the CSAT and the Chemical-Security 
Management System information technology systems, and acquiring important technical and 
subject matter support. Additionally, CFATS-related outreach and engagement with the 
regulated community would be significantly reduced and some aspects would cease; 
development and implementation of the proposed Ammonium Nitrate Security Program would 
be significantly delayed; and many of the managerial improvements outlined in the ISCD Action 
Plan may be delayed or negatively impacted. 


Legislation to Permanently Authorize CFATS 

DHS recognizes the significant work that the Subcommittee and others have accomplished to 
reauthorize the CFATS program. The Department supports a permanent authorization for the 
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CFATS program and is committed to working with Congress and other security partners to 
establish a permanent authority for the CFATS program in Federal law. We appreciate this 
effort and look forward to continuing engagement with Congress on these important matters. 

Conclusion 

ISCD, NPPD, and the Department are moving forward quickly and strategically to address the 
challenges before us. CFATS is reducing the risks associated with our Nation’s chemical 
infrastructure. We believe that CFATS is making the Nation safer and are dedicated to its 
success. As we implement CFATS, we will continue to work with stakeholders to get the job 
done, meet the challenges identified in the ISCD report, and execute a program to help prevent 
terrorists from exploiting chemicals or chemical facilities. 

Thank you for holding this important hearing. I would be happy to respond to any questions you 
may have. 
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Opening Statement: Director Wule 

Mr. Aderholt. Thank you, Secretary Spaulding. As you may 
know, as I mentioned, votes were we thought were going to he 
called. And since open testimony has began we have been called for 
about 20 votes on the floor. But before we adjourn here, what I 
would like to do is to recognize Mr. Dave Wulf. If you could just 
take maybe two minutes to briefly overview some of your comments 
so that we can do that before we adjourn for the time being? 

Mr. Wule. Thank you, Mr. Chairman. I would also like to thank 
the members of the committee for the opportunity to be here today. 
As Deputy Under Secretary Spaulding noted, we have made signifi- 
cant progress in the months since the development of our action 
plan. 

You know, working closely with the Office of Infrastructure Pro- 
tection and NPPD and through a great deal of hard work on the 
part of the talented men and women of ISCD, we have completed 
work on 59 of the 95 items outlined in our action plan. Among 
other things, we have developed improved policies, procedures and 
training to conduct inspections in a consistent and effective fash- 
ion, and last week we did recommence the conduct of authorization 
inspections. We have developed and have begun implementing a 
sustainable and efficient SSP [site security plan] review process 
that will streamline our ability to authorize and approve site secu- 
rity plans. We are moving to stabilize our leadership cadre by hir- 
ing permanent supervisors. And we continue to foster transparency 
and open communication throughout our organization. 

We really are at a critical juncture in the implementation of 
CFATS. With the development of our SSP review process, comple- 
tion of the work of our inspector tools working group, the conduct 
of our ongoing inspector training, and the recommencement of au- 
thorization inspections, we are poised to make great progress in the 
coming months. Along with the rest of the team at ISCD, I am ex- 
cited and very optimistic about the future of the CFATS program. 

We continue to engage our industry stakeholders in meaningful 
dialogue. And I very much appreciate industry’s continued support 
for the CFATS program. We do look forward to a full and produc- 
tive dialogue on the issue of personnel surety as we all strive to 
prevent terrorists from gaining access to our nation’s highest risk 
chemical infrastructure while ensuring the chemical facilities are 
able to continue conducting business without the imposition of un- 
necessary burdens 

I am also grateful to the American Federation of Government 
Employees [AFGE], which represents the bargaining unit employ- 
ees of our field force. In partnership with ISCD, AFGE has done 
much to help us expedite our adoption of improved procedures as 
we have moved aggressively to develop our inspection processes 
and to recommence inspections. As Deputy Under Secretary 
Spaulding noted, we also appreciate the work done by the Govern- 
ment Accountability Office and we will move forward to adopt the 
recommendation GAO has made for additional performance meas- 
ures, tying our action plan to the progress we anticipate making 
across the CFATS program. 
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I am honored to have been asked to serve as the Director of 
ISCD and I look forward to continuing to lead the talented men 
and women of the division. The level of experience and profes- 
sionalism that is present across our division is truly humbling. Our 
team has brought to ISCD a wealth of experience from careers in 
industry, law enforcement, military service, and a host of other dis- 
ciplines. And I believe we have made much progress in coming to- 
gether as a regulatory compliance organization that is committed 
100 percent to the critical mission of securing our nation’s highest 
risk chemical infrastructure. 

Thank you again for the opportunity to be here today, and I wel- 
come any questions you may have. 

Mr. Aderholt. Thank you, Mr. Wulf. And as I mentioned, the 
votes have been called, and from the looks of it, we are going to 
be on the floor for approximately two hours. We are going to sus- 
pend the hearing as a result of the votes. But I do thank the wit- 
nesses for their attendance and look forward as we continue to 
have this hearing at a later date. Thank you very much. 
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Opening Statement: Chairman Robert Aderholt 

Mr. Aderholt. Good morning. The hearing is called to order. 
Today we reconvene from our hearing back in July that was inter- 
rupted shortly after we began the hearing. 

And of course, we will be discussing the Department of Home- 
land Security’s Chemical Security Anti-Terrorism Standards pro- 
gram, which is known as CFATS. We welcome back NPPD Under 
Secretary Suzanne Spaulding; Director David Wulf; and Mr. Ste- 
phen Caldwell from the GAO. 

Your statements, of course, have been previously given, so we 
can proceed into the questioning portion of the hearing. So, before 
we begin, I would like to recognize the ranking member of the sub- 
committee, Mr. Price, for any comments that he would like to 
make. 

[The information follows:] 
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The Honorable Robert Aderholt 
Committee on Appropriations 
Subcommittee on Homeland Security 

Opening Statement: 

Chemical Security Anti-Terrorism Standards Program 
Witnesses: 

Deputy Under Secretary Suzanne Spaulding 
National Protection and Programs Directorate 

Mr, David Wulf 

Director, Office of Infrastructure Compliance 
Steven Caldwell 

Director, Infrastructure Protection Issues 
Homeland Security and Justice Team 
Government Accountability Office 

10:00 AM I Thursday | September 20, 2012 | RHOB 2359 

Today we will reconvene the hearing that was interrupted in July to discuss the 
Department of Homeland Security’s Chemical Security Anti-Terrorism Standards 
(CFATS) program. 

We welcome back NPPD Deputy Under Secretary Suzanne Spaulding, Director David 
Wulf and Mr. Steven Caldwell from the Government Accountability Office, 

Your statements have previously been given so we will proceed directly to 
questions. Before we begin, however, 1 recognize Ranking Member Price, for any 
additional remarks he would like to make. 
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Mr. Price. Thank you, Mr. Chairman. 

I do not have an opening statement and am very happy to pro- 
ceed with the questions. 

Mr. Aderholt. Thank you, Mr. Price. 

Mr. Caldwell, you note in your remarks earlier in your written 
statement the fact that there is a need for performance measures. 
My question to you would he whether GAO has worked with NPPD 
on the issue? And has NPPD heen receptive to the idea of perform- 
ance metrics. 

[Opening statement of Stephen Caldwell follows:] 
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CRITICAL INFRASTRUCTURE PROTECTION 

Summary of DHS Actions to Better Manage Its 
Chemical Security Program 


What GAO Found 

The November 2011 memorandum that discussed the management of the 
Chemical Fadlity Anti-Terrorism Standards (CFATS) program was prepared 
based primarily on the observations of the former Director of the Department of 
Homeland Security’s (DHS) Infrastructure Security Compliance Division (ISCD), 
a division of the Office of Infrastructure Protection (IP) within the National 
Protection and Programs Directorate (NPPD). The memorandum was intended to 
highlight various challenges that have hindered ISCD efforts to implement the 
CFATS program. According to the former Director, the challenges facing ISCD 
included not hawng a fully developed direction and plan for implementing the 
program, hiring staff without establishing need, and inconsistent iSCD 
leadership— factors that the Director believed place the CFATS program at risk. 
These challenges centered on three main areas: (1) human capital issues, 
including problems hiring, training, and managing ISCD staff; (2) mission issues, 
including problems reviewing facility plans to mitigate security vulnerabilities; and 
(3) administrative issues, Including concerns about NPPD and IP not supporting 
(SCO's management and administrative functions. 

ISCD has begun to take various actions intended to address the issues identified 
in the ISCD memorandum and has developed a 94'item action plan to track its 
progress. According to ISCD managers, the plan appears to be a catalyst for 
addressing some of the long-standing issues the memorandum identified. As of 
June 2012, ISCD reported that 40 percent (38 of 94) of the items in the plan had 
been completed. These include requiring ISCD managers to meet with staff to 
involve them in addressing challenges, clarifying priorities, and changing ISCD's 
culture; and developing a proposal to establish a quality control function over 
compliance activities. The remaining 60 percent (66 of 94) that were In progress 
include those requiring longer-term efforts — i.e., streamlining the process for 
reviewing facility security plans and developing facility inspection processes; 
those requiring complefaon of other items in the plan; or those awaiting action by 
others, such as approvals by ISCD leadership. ISCD appears to be heading in 
the right direction, but it is too early to tell if individual items are having their 
desired effect because ISCD is in the early stages of implementing them and has 
not yet established performance measures to assess results. 

According to ISCD officials, almost half of the action items included in the June 
2012 action plan require ISCD collaboration with or action by NPPD and IP. The 
ISCD memorandum stated that IP and NPPD did not provide the support needed 
to manage the CFATS program when the program was first under development. 
ISCD, IP. and NPPD officials confirmed that IP and NPPD are now providing 
needed support and stated that the action plan prompted them to work together 
to address the various human capital and administrative issues identified. 
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Chairman Aderholt, Ranking Member Price, and Members of the 
Subcommittee: 

I am pleased to be here today to discuss the Department of Homeland 
Security’s (DHS) efforts to address the various challenges in 
implementing and managing the Chemical Facility Anti-Terrorism 
Standards (CFATS) program. My statement today summarizes the 
testimony I delivered on July 26. 2012, before this Subcommittee.^ The 
events of September 1 1 , 2001 , triggered a national re-examination of the 
security of facilities that use or store hazardous chemicals in quantities 
that, in the event of a terrorist attack, could put large numbers of 
Americans at risk of serious injury or death. Chemicals held at these 
facilities can be used to cause harm to surrounding populations during 
terrorist attacks; can be stolen and used as chemical weapons or as 
precursors (the Ingredients for making chemical weapons); or stolen and 
used to build an improvised explosive device. To mitigate this risk, the 
DHS appropriations act for fiscal year 2007^ required DHS to issue 
regulations to establish risk-based performance standards for securing 
high-risk chemical facilities, among other things.® DHS established the 
CFATS program to assess the risk, if any, posed by chemical facilities: 
place high-risk facilities in one of four risk-based tiers: require high-risk 
facilities to develop security plans; review these plans: and inspect the 
facilities to ensure compliance with the regulatory requirements. DHS's 
National Protection and Programs Directorate (NPPD) is responsible for 
the CFATS program. Within NPPD, the Infrastructure Security 
Compliance Division (ISCD), a division of the Office of Infrastructure 
Protection (IP), manages the program. 

A November 2011, internal ISCD memorandum, prepared by iSCD’s 
former Director in consultation with the former Deputy Director^ and 


^GAO, Critical Infrastructure Protection: DHS Is Taking Action to Better Manage Its 
Chemical Security Program, but It Is loo Early to Assess Results, GAO-12-51 5T 
(Washington, D.C.: July 2012). 

2pub. L No. 109-295, § 550. 120 Stat. 1355, 1388 (2006). 

^According to DHS. a high-risk chemical facility is one that, in the discretion of the 
Secretary of HomelarKi Security, presents a high risk of significant adverse consequences 
for human life or health, national security, or witical economic assets if subjected to a 
ten-orist attack, compromise, infiltration, or exploitation. 6C.F.R, §27.105. 

'’The ISCD director who prepared the internal memorandum is no longer in that position, 
and the deputy director who assisted with the internal memorandum is now the director. 
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designated by DHS as “for official use only” (FOUO), expressed concerns 
about the management of the CFATS program. The !SCD memorandum, 
which was leaked to the media in December 201 1 . cited an array of 
challenges that, according to these officials, hindered ISCD’s ability to 
implement and manage the CFATS program,® My statement today 
discusses: (1) how the memorandum was developed and what 
challenges were identified; (2) what actions are being taken to address 
the challenges identified; and (3) the extent to which ISCD’s planned 
actions and proposed solutions require action to be taken by or in 
collaboration with NPPD or IP. 

This statement is based on work we recently completed for this 
subcommittee on the ISCD memorandum and related actions. To conduct 
this work, we reviewed applicable laws and regulations, as well as NPPD, 
IP, and ISCD policies and procedures for administering the CFATS 
program, analyzed the ISCD memorandum prepared by the former ISCD 
Director in consultation with the former Deputy Director, compared it with 
the proposed action plan ISCD officials prepared to address the 
challenges identified, and compared subsequent action plans to monitor 
ISCD’s progress.® Our results are based on the ISCD’s action plan as of 
June 2012 so these results reflect the status of ISCD’s progress up to that 
point in time. The details of our scope and methodology can be found In 
our July 2012 statement. In August 2012, ISCD provided us with an 
updated action plan which we used to document the additional action 
items completed between June 2012 and August 2012. We did not verify 
that the status of these action items. 

We conducted this performance audit from February 2012 to July 2012 In 
accordance with generally accepted government auditing standards. 
Those standards require that we plan and perform the audit to obtain 
sufficient, appropriate evidence to provide a reasonable basis for our 
findings and conclusions based on our audit objectives. We believe that 
the evidence obtained provides a reasonable basis for our analysis based 
on our audit objectives. 


^According to DHS officials, the ISCD memorandum was never intended to be publically 
released. 

®We initially reviewed an ISCD action plan developed in January 2012. ISCD periodically 
updated the plan to monitor progress on the action items and we reviewed 8 versions of 
the action plan up to and including one developed in June 2012- 
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Background 


Section 550 of the DHS appropriations act for fiscal year 2007^ requires 
OHS to issue regulations establishing risk-based performance standards* 
for the security of facilities that the Secretary determines to present high 
levels of security risk, among other things. The CFATS rule was published 
in April 2007* and Appendix A to the rule, published in November 2007, 
listed 322 chemicals of interest and the screening threshold quantities for 
each.™ iSCD has direct responsibility for implementing DHS's CFATS rule, 
including assessing potential risks and identifying high-risk chemical 
facilities, promoting effective security planning, and ensuring that final high- 
risk facilities meet the applicable risk-based performance standards 
through site security plans approved by DHS. ISCD is managed by a 
Director and a Deputy Director and operates five branches that are, among 
other things, responsible for information technology operations, policy and 
planning, and providing compliance and technical support. From fiscal 
years 2007 through 2012, DHS dedicated about $442 million to the CFATS 
program. During fiscal year 2012, ISCD was authorized 242 full-time- 
equivalent positions. For fiscal year 201 3, DHS’s budget request for the 
CFATS program was $75 million and 242 positions. 


'Pub. L, No. 109-295. S 550, 120 Slat, 1355, 1388 (2006). 

*The CFATS rule establishes 18 risk-based performance standards that identify the areas 
for which a facility’s security posture are to be examined, such as perimeter security, 
access control, and cyber security. To meet these standards, facilities are free to choose 
whatever security programs or processes they deem appropriate so long as DHS 
determines that the facilities achieve the requisite level of performance in each applicable 
standard. 

^72 Fed. Reg. 17.686 (Apr. 9, 2007) (codified at 6 C.F.R. pt. 27). 

’°72 Fed- Reg. 65.396 (Nov. 2007). According to DHS, CFATS not oniy covers 
fedlities that manufacture chemicals but also covers facilities that store or use certain 
chemicals as part of their daily operations. This can include food-manufacturing facilities 
that use chemicals of interest in the manufacturing process, farms that use certain 
quantities of ammonium nitrate or urea fertilizers, or universities that use chemicals to do 
experiments. 
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Senior ISCD Leaders 
Developed the ISCD 
Memorandum to 
Highlight Various 
Challenges Hindering 
CFATS 

Implementation 


ISCD’s Memorandum 
Based Largely on 
Observations of Senior 
ISCD Managers 


Our review of the ISCD memorandum and discussions with ISCD officials 
showed that the memorandum was developed during the latter part of 
2011 and was developed primarily based on discussions with ISCD staff 
and the observations of the ISCD former Director in consultation with the 
former Deputy Director. In November 201 1 , the former Director and 
Deputy Director provided the Under Secretary with the ISCD 
memorandum entitled “Challenges Facing ISCD, and the Path Forward." 
These officials stated that the memorandum was developed to inform 
leadership about the status of ISCD. the challenges It was facing, and the 
proposed solutions identified to date, In transmitting a copy of the 
memorandum to congressional stakeholders following the leak in 
December 201 1 . the NPPD Under Secretary discussed caveats about the 
memorandum, including that it had not undergone the normal review 
process by DHS's Executive Secretariat and contained opinions and 
conclusions that did not reflect the position of DHS. 

The former ISCD Director stated that the memo was intended to begin a 
dialog about the program and challenges it faced. The former Director 
confirmed that she developed the memorandum by (1) surveying division 
staff to obtain their opinions on program strengths, challenges, and 
recommendations for Improvement: (2) observing CFATS program 
operations, including the security plan review process; and (3) analyzing 
an internal DHS report on CFATS operations,'''' which, according to the 
former Director served as a basis for identifying some administrative 


"DHS Office of Compliance and Security. National Protection and Programs Directorate. 
Infrastructure Security Comf^iance Division (ISCD) Program Inspection, April-Seplember, 
2011 . 
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challenges and corrective action. The senior ISCD and NPPD officials we 
contacted said that they generally agreed with the material that they saw, 
but noted that they believed the memorandum was missing context and 
balance. For example, one NPPD official staled that that the tone of the 
memorandum was too negative and the problems it discussed were not 
supported by sound evaluation. However, the official expressed the view 
that the CFATS program is now on the right track. 


ISCD Management Was 
Concerned That 
Challenges Place the 
CFATS Program at Risk 


The ISCD memorandum discussed numerous challenges that, according to 
the former Director, pose a risk to the program. The former Director pointed 
out that, among other things, ISCD had not approved any site security 
plans or carried out any compliance inspections on regulated facilities. The 
former Director attributed this to various management challenges, including 
a lack of planning, poor internal controls, and a workforce whose skills were 
inadequate to fulfill the program’s mission, and highlighted several 
challenges that have had an impact on the progress of the program. In 
addition, the memorandum provided a detailed discussion of the issues or 
problems facing ISCD, grouped into three categories: (1) human capital 
management, such as poor staffing decisions; (2) mission issues, such as 
the lack of an established inspection process; and (3) administrative issues, 
such as a lack of infrastructure and support, both within ISCD and on the 
part of NPPD and IP. 


ISCD Has Begun to 
Take Various Actions 
Intended to Address 
Challenges Identified 


ISCD’s Action Plan 
Included Time Frames and 
Appears to be Helping 
Address Some Legacy 
Issues 


ISCD is using an action plan to track its progress addressing the 
challenges identified in the memorandum, and, according to senior 
division officials, the plan may be helping them address some legacy 
issues that staff were attempting to deal with before the memorandum 
was developed. The January 2012 version of the proposed action plan 
listed 91 actions to be taken categorized by issue— human capital 
management issues, mission issues, or administrative Issues — ^that, 
according to the former ISCD Director, were developed to be consistent 
with the ISCD memorandum. However, the January 2012 version of the 
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action plan did not provide information on when the action was started or 
to be finished. Eleven of the 12 ISCD managers (other than the former 
Director and Deputy Director) assigned to work as the coordinators of the 
individual action items told us that even though they were not given the 
opportunity to view the final version of the iSCD memorandum, the former 
Director provided them the sections of the action plan for which they were 
responsible to help them develop and implement any corrective actions. 
They said that they agreed that actions being taken in the plan were 
needed to resolve challenges facing ISCD. Our discussions with these 
officials also showed that about 39 percent (37 of 94) of the items in the 
March and June 2012 action plans addressed some legacy issues that 
were previously identified and, according to these officials, corrective 
actions were already undenivay for all 37 of these items. 


ISCD’s June 2012 Plan Our analysis of the June 2012 version of the ISCD action plan showed 

Update Showed 38 Action •^'3' '•O percent of the items in the plan (38 of 94) had been completed. 
Items Completed remaining 60 percent (56 of 94) were in progress. Of the 38 

completed items, we determined that 32 were associated with human 
capital management and administrative issues, including those Involving 
culture and human resources, contracting, and documentation. The 
remaining 6 of 38 action items categorized by iSCD as completed were 
associated with mission issues. Figure 1 shows the status of action items 
by each of the three categories as of June 2012. 
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Figure 1 : Status of ISCD Action Plan by Category, as of June 201 2 
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For the remaining 56 items that were in progress as of June 2012, 40 
involved human capital management and administrative issues. 

According to ISCD officials, these 40 issues generally involved longer- 
term efforts — such as organizational realignment— or those that require 
approval or additional action on the part of IP or NPPD. Sixteen of 66 
remaining actions items in progress covered mission issues that will likely 
also require long-term efforts to address. 

As of August 2012, ISCD reported that it had completed another 21 action 
items, of which 8 were to address mission-related issues. We did not 
verify ISCD's efforts to complete actions since June 2012. However, we 
have recently begun a follow-up review of CFATS at the request of this 
and other committees, which will focus on DHS’s efforts to address 
mission-related issues. We expect to report the results of these efforts 
early in 2013. 
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Almost Half of ISCD’s 
Action Item Completion 
Dates Had Been Extended 
since April 2012 


Our analysis of the April and June versions of the plan shows that the 
division had extended the estimated completion dates for nearly half of 
the action items. Estimated completion dates for 52 percent (48 of 93 
items)’^ either did not change (37 items) or the date displayed in the June 
201 2 plan was earlier than the date in the April 2012 version of the plan 
(1 1 items). Conversely, 48 percent (45 of 93) of the items in the June 
2012 version of the plan had estimated completion dates that had been 
extended beyond the date in the April 2012 plan. Figure 2 shows the 
extent to which action plan items were completed earlier than planned, 
did not change, or were extended, from April 2012 through June 2012, for 
the human capital management, mission, and administrative issues 
identified In the plan. 


’^tSCD data showed that 93 of 94 action items were consistent between the April 20t2 
and June 2012 action plans; therefore, computation of the estimated completion dates 
was based on 93 total items. One action item in the April 2012 plan dealing with strategies 
for managing ISCD funding levels was removed from the June 2012 plan because after 
the analysis was prepared and submitted to NPPD, the decision was made to delete the 
item from the plan. The funding action item was replaced in the June 2012 action plan with 
an action item to conduct a peer review of the facility tiering process and formula. For 
purposes of this analysis, we used the 93 action items (instead of 94 action items) that 
wens consistent between the April and June 2012 action plans. 
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Figure 2: Change In CFATS Action Plans Estimated Completion Dates from April 2012 to June 2012 
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’!SCD data showed Utat 93 of 94 action items were consistent between the April 2012 and dune 2012 
action plans, therefore, computation of the estimated com^etion dates was based on 93 total items. 
One action item in the A|Mil 201 2 plan dealing with strategies for managing ISCD funding levels was 
removed from ^e June 2012 pten because after the analysis was prepared and submitted to NPPD, 
the decision was made to delete the item from the plan. The Ending action Item was re^aced in the 
June 201 2 with an action item to conduct a peer review of the facility tiedng process and formula. For 
purposes of this analysis, we used the 93 action items that were consistent between the April and 
June 2012 action plans. 



ISCD officials told us that estimated completion dates had been extended 
for various reasons. For example, one reason for moving these dates was 
that the work required to address some items was not fully defined when 
the plan was first developed and as the requirements were better defined, 
the estimated completion dates were revised and updated, in addition, 
ISCD officials also stated that timelines had been adversely affected for 
some action items because staff had been reassigned to work on higher 
priority responsibilities, such as reducing the backlog of security plans 
under review. 
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Action Plan Performance 
Measures Could Help 
Gauge Progress 


ISCD, through its action plan, appears to be heading in the right direction 
towards addressing the challenges identified, but it is too early to tell if the 
action plan is having the desired effect because (1) the division had only 
recently completed some action items and continues to work on 
completing more than half of the others, some of which entail long-term 
changes, and (2) ISCD had not yet developed an approach for measuring 
the results of its efforts. ISCD officials told us that they had not yet begun 
to plan or develop any measures, metrics, or other documentation 
focused on measuring the impact of the action plan on overall CFATS 
implementation because they plan to wait until corrective action on all 
items has been completed before they can determine the impact of the 
plan on the CFATS program. For the near term, ISCD officials stated that 
they plan to assess at a high level the impact of the action plan on 
CFATS program implementation by comparing ISCD’s performance rates 
and metrics pre-action plan implementation and post-action plan 
implementation.” However, because ISCD will not be completing some 
action items until 2014, it will be difficult for ISCD officials to obtain a 
complete understanding of the impact of the plan on the program using 
this comparison only. 

In our July 2012 statement, we recommended that ISCD look for 
opportunities, where practical, to measure results of their efforts to 
implement particular action items, and where performance measures can 
be developed, periodically monitor these measures and indicators to 
identify where corrective actions, if any, are needed. The agency 
concurred with our recommendation and developed a new action item 
(number 95) intended to develop metrics for measuring, where practical, 
results of efforts to implement action plan items, including processes for 
periodic monitoring and indicators for corrective actions. This action item 
is in progress. 


^According to tSCO officials. ISCD uses a performance measure to track the 
perfotmance of the CFATS program overall, but as of June 201 2 did not have 
performance measures in place to track the progress of the action plan, or particular 
action items. 
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ISCD Officials Stated 
That Almost Half of 
the Action Items 
Required 

Collaboration with or 
Action by NPPD or IP 


According to (SCO officials, almost haif of the action items included in the 
June 2012 action plan either require iSCD to collaborate with NPPD and IP 
or require NPPD and IP to take action to address the chalienges identified 
in the ISCD memorandum. NPPD, IP, and ISCD officials have been 
working together to identify solutions to the challenges the memorandum 
identified and to close pertinent action items. According to division officials, 
46 of the 94 action items included in the June 2012 action plan required 
action either by NPPD and IP or collaboration with NPPD and IP. This 
includes collaborating with NPPD officials representing the NPPD human 
capital, facilities, and employee and labor relations offices, among others, 
and with IP's Directorateof Management Office.” As of June 2012, 13 of 
the 46 items that require action by or collaboration with NPPD or IP were 
complete; 33 of 46 were in progress. As of August 2012, ISCD reported 
that it had completed 8 more of these action items, such that 21 of the 46 
were complete and 25 were in progress. We did not verify ISCD's efforts to 
close these additional action items. 


Chairman Aderholt, Ranking Member Price, and members of the 
subcommittee, this completes my prepared statement. I would be happy 
to respond to any questions you may have at this time. 
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GAO’s Mission 

The Government Accountability Office, the audit, evaluation, and 
investigative arm of Congress, exists to support Congress in meeting its 
constitutional responsibilities and to help improve the performance and 
accountability of the federal government for the American people. GAO 
examines the use of public funds; evaluates federal programs and 
policies; and provides analyses, recommendations, and other assistance 
to help Congress make informed oversight, policy, and funding decisions. 
GAO’s commitment to good government is reflected in its core values of 
accountability, integrity, and reliability. 
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Mr. Caldwell. Certainly when we did that earlier work, we 
started talking about performance measures. We did talk to the 
NPPD folks and they were receptive to that. I think we didn’t want 
to be to prescriptive as to what those measures would be since it 
is their program and they know it better. So I think the phrase- 
ology we used for that recommendation was more practical. Some 
of the things in the action plan I don’t think they needed, a per- 
formance metric for every single one of those things, some of them 
are just compliance issues, such as fleet management or overtime, 
things they need to manage better. But particularly were items re- 
lated to the core mission of actually doing inspections in the plan 
and then when you start to develop a backlog, how you manage 
your backlog, those are the things they will want performance 
measures on. 

Mr. Aderholt. But I guess you would agree that it is difficult 
to measure, unless you do have some type of metrics, and of course, 
any action plan needs some type of metrics to make sure that 
progress is being made. I would assume you would agree with that. 

Mr. Caldwell. Yes. The simplest, obviously, some of the items 
are open and may be relatively easy to close, and then they are 
marked as closed. But again, the challenge for them in the longer 
term is going to be the performance measures related to, are they 
improving security? I mean, it is one thing to know how many 
plans do you have and how many inspections have you done and 
those kinds of things, and so sometimes in security programs like 
this, those have to serve as a bit of a proxy to, how is the program 
moving along and things like that, as opposed to actually meas- 
uring the risk at any individual facility or something like that. But 
I certainly agree with your basic point; they need to monitor this. 

SITE SECURITY PLANS: APPROVALS/AUTHORIZATIONS 

Mr. Aderholt. Secretary Spaulding, one of the issues raised in 
the report is the lack of approved site security plans. In January, 
not one plan has been approved. And only 49 of the 114 tier 1 
plans had been authorized. I understand that as of this week, 
NPPD has authorized 71 plans and only 23 more than in January, 
even though NPPD has stated in January that it would have all 
114 plans authorized or denied by the spring of this year. Could 
you speak to a little bit about that? 

[Opening statement of Suzanne Spaulding follows:] 
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Thank you. Chairman Aderholt, Ranking Member Price, and distinguished Members of the 
Subcommittee. It is a pleasure to appear before you today to discuss the Department of 
Homeland Security's (DHS) efforts to regulate the security of high-risk chemical facilities under 
the Chemical Facility Anti-Terrorism Standards (CFATS). 

As you are aware, the Department's current statutory authority to implement CFATS - Section 
550 of the Fiscal Year (FY) 2007 Department of Homeland Security Appropriations Act, as 
amended - has been extended through October 4, 2012, and is about to be further extended by 
the FY 201 3 Continuing Appropriations Resolution once that has been enacted. The CFATS 
program has made our Nation more secure and DHS welcomes the opportunity to continue to 
work with Congress, all levels of government, and the private sector to further improve this vita! 
national security program. 

CFATS has helped to make our country safer. Since the inception of CFATS, more than 2,700 
chemical facilities have eliminated, reduced, or otherwise made modifications to their holdings 
of potentially dangerous chemicals and are now no longer considered high-risk. 

In the interest of building upon our collaboration, my testimony today focuses on the current 
status of the program, examples of the program’s successes to date, some of the current 
challenges facing the National Protection and Programs Directorate (NPPD) in implementing 
CFATS, and the actions we are taking to address these challenges through the Infrastructure 
Security Compliance Division (ISCD) Action Plan. Progress has been made on all of the Action 
Plan action items that remain open, and I would be glad to discuss both the progress made by the 
Department on these action items as well as the path forward the Department has charted for 
completing these items. Equally as important, I will reiterate the principles that we believe 
should guide the program's maturation and continued authorization. 

1 am pleased to inform you that the Department has completed 68 of the 95 action items included 
in the Action Plan. It should be noted that this is significantly higher than the number reported 
by the Government Accountability Office (GAO) in its July 2012 report, as the Department 
continues to work on and complete action items following the conclusion of the GAO audit. I 
would also like to thank GAO for their efforts in reviewing the CFATS program. We have made 
progress in addressing identified challenges, but more remains to be done. 

At Under Secretary Beers’ direction, the program’s leadership has outlined its priorities, the 
challenges it believes the program faces, and a proposed path forward to address those 
challenges and accomplish program objectives. NPPD, the Directorate with oversight 
responsibility for the CFATS program, is continuously reviewing the program to identify areas 
for improvement and correcting course when necessary to ensure proper implementation. 

Chemical Facility Security Regulations 

Section 550 of the FY 2007 Department of Homeland Security Appropriations Act directed the 
Department to develop and adopt within six months a regulatory framework to address the 
security of chemical facilities that the Department determines pose high levels of risk. 
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Specifically, Section 550(a) of the Act authorized the Department to adopt regulatory 
requirements for high-risk chemical facilities to complete Security Vulnerability Assessments 
(SVAs), develop Site Security Plans (SSPs), and implement protective measures necessary to 
meet risk-based performance standards established by the Department, Consequently, the 
Department published an interim final rule, known as CFATS, on April 9, 2007. Section 550, 
however, expressly exempts from the regulation certain facilities that are regulated under other 
federal statutes, specifically those regulated by the United States Coast Guard (USCG) pursuant 
to the Maritime Transportation Security Act (MTSA), drinking water and wastewater treatment 
facilities as defined by Section 1401 of the Safe Water Drinking Act and Section 212 of the 
Federal Water Pollution Control Act, and facilities owned or operated by the Departments of 
Defense or Energy, as well as certain facilities subject to regulation by the Nuclear Regulatory 
Commission (NRC). 

The following core principles guided the development of the CFATS regulatory structure: 

1 . Securing high-risk chemical facilities is a comprehensive undertaking that involves a 
national effort, including all levels of government and the private sector. Integrated and 
effective participation by all stakeholders — federal, state, local, tribal and territorial 
government partners as well as the private sector — is essential to securing our critical 
infrastructure, including high-risk chemical facilities 

2. Risk-based tiering is used to guide resource allocations. ’ Not all facilities present the 
same level of risk. The greatest level of scrutiny should be focused on those facilities 
that present the highest risk — those that, if targeted, would endanger the greatest number 
of lives; 

3. Reasonable, clear, and calibrated performance standards will lead to enhanced security. 
The CFATS rule establishes enforceable risk-based performance standards (RBPS) for 
the security of our Nation’s chemical facilities. High-risk facilities have the flexibility to 
develop appropriate site-specific security measures that will effectively address risk by 
meeting these standards. ISCD will analyze all final high-risk facility SSPs to ensure 
they meet the applicable RBPS and will approve those that do. If necessary, ISCD will 
work with a facility to revise and resubmit an acceptable plan and can disapprove security 
plans if an acceptable plan is not submitted; and 

4. Recognition of the progress many companies have already made in improving facility 
security leverages those advancements. Many companies made significant capital 
investments in security following 9/1 1, and even more have done so since the passage of 
the legislation establishing this program. 


Viering determinations are dynamic; for example, a tiering determination can change when a company voluntarily alters its facilities in a way 
that reduces its risk profile. "Rnai tiering" refers to a tiering assignment following a Security Vulnerability Assessment —It does not imply that 
this is the final tiering assignment a facility may ever receiw. 
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Rule Implementation 

On November 20, 2007, the Department published CFATS’ Appendix A, which lists 322 
chemicals of interest - including common industrial chemicals such as chlorine, propane, and 
anhydrous ammonia - as well as specialty chemicals, such as arsine and phosphorus trichloride. 
The Department included chemicals based on the potential consequences associated with one or 
more of the following three security issues: 

1 . Release - Toxic, flammable, or explosive chemicals that have the potential to create 
significant adverse consequences for human life or health if intentionally released or 
detonated; 

2. Theft/Diversion - Chemicals that have the potential, if stolen or diverted, to be used as or 
converted into weapons that could cause significant adverse consequences for human life 
or health; and 

3. Sabotage/Contamination - Chemicals that are shipped and that, if mixed with other 
readily available materials, have the potential to create significant adverse consequences 
for human life or health. 

The Department also established a Screening Threshold Quantity for each chemical of interest 
based on its potential to create significant adverse consequences to human life or health in one or 
more of these ways. Any chemical facility that possesses any chemical of interest at or above the 
applicable Screening Threshold Quantity must submit an initial consequence-based screening 
tool, commonly referred to as the “Top-Screen,” to DHS. Through the Top-Screen process, 

ISCD identifies high-risk facilities, which the Department then assigns to one of four preliminary 
risk-based tiers, with Tier 1 representing the highest level of potential risk. 

Implementation of the CFATS regulation requires the Department to identify which facilities it 
considers high-risk. Supporting this, ISCD developed the Chemical Security Assessment Tool 
(CSAT) to help the Department identify potentially high-risk facilities and to provide 
methodologies those facilities can use to conduct SVAs and to develop SSPs. CSAT is a suite of 
online applications designed to facilitate compliance with the program; it includes user 
registration, the Top-Screen, an SVA tool, and an SSP template. The CSAT tool is a secure tool 
that can be accessed only by Chemical-terrorism Vulnerability Information (CVl) authorized 
users. 

In May 2009, DHS issued Risk-Based Performance Standards Guidance to assist final high-risk 
chemical facilities in determining appropriate protective measures and practices to satisfy the 
RBPS. It is designed to help facilities comply with CFATS by providing detailed descriptions of 
the 18 RBPS as well as examples of various security measures and practices that could enable 
facilities to achieve the appropriate level of performance for the RBPS at each tier level. The 
Guidance was informed by the experience of the Transportation Security Administration (TSA), 
U.S. Coast Guard (USCG), and the Environmental Protection Agency (EPA), and also reflects 
public and private sector dialogue on the RBPS and industrial security, including public 
comments on the draft guidance document. High-risk facilities are free to make use of whichever 
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security programs or processes they choose - whether or not in the Guidance - provided that 
DHS determines through approval of the facilities’ SSPs that they achieve the requisite level of 
performance under the CFATS KBPS. 

Implementation Status 

To date, ISCD has received more than 41,000 Top-Screens submitted by chemical facilities. 
Since June 2008, ISCD identified more than 8,000 facilities that it has initially designated as 
high-risk. These facilities have used the CSAT tool to compile and submit SVAs. In May 2009, 
following reviews of facilities’ SVA submissions, ISCD began notifying facilities of their final 
high-risk determinations, risk-based tiering assignments, and the requirement to complete and 
submit an SSP or an Alternative Security Program (ASP) in lieu of an SSP. 

As of September 4, 2012, CFATS covers 4,433 high-risk facilities nationwide; of these, 3,660 
facilities are currently subject to final high-risk determinations and submission of an SSP or 
ASP. The remaining facilities are awaiting final tier determinations based on their SVA 
submissions. ISCD continues to issue final tier notifications to facilities across all four risk tiers 
as it makes additional final tier determinations. 

Personnel Surety. Under CFATS Risk-Based Performance Standard 12 (KBPS 12), final high- 
risk chemical facilities are required to perform background checks on certain individuals with 
access to restricted areas or critical assets. NPPD has been seeking to implement a CFATS 
Personnel Surety Program to enable facilities to comply with the requirement to identify 
individuals who may pose a risk to chemical security by enabling facilities to submit 
biographical information to NPPD. NPPD would compare this biographical information against 
information about known or suspected terrorists listed in the Terrorist Screening Database 
(TSDB). 

Since submitting an Information Collection Request (ICR) to 0MB in June of 201 1, the 
Department’s position on how facilities can comply with RBPS 12 has evolved, thanks in large 
part to information the chemical industry has provided to us as part of the PRA process. As a 
result, in July of 20 1 2, the Department withdrew the ICR from 0MB review. This has enabled 
the Department to engage in direct dialogue with security partners and with stakeholders in the 
regulated community about the CFATS Personnel Surety Program. Additionally, the 
Department has learned a great deal about various facilities through visits to chemical facilities it 
has conducted. This on the ground knowledge of the facilities will help to inform the 
Department of the impacts of the Personal Surety Program will have. The Department plans to 
re-initiate the PRA process by publishing a 60-day notice to solicit comment in the Federal 
Register in the near future. After that, the Department will concurrently publish a 30-day notice 
to solicit additional comments, and submit a new ICR for the CFATS Personnel Surety Program 
to OMB for review. 

Outreach Efforts 

Since the establishment of CFATS in April 2007, NPPD and ISCD have taken significant steps 
to publicize the rule and ensure that the regulated community and other interested or affected 
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entities are aware of its requirements. NPPD and ISCD management and staff have presented at 
hundreds of security and chemical industry conferences and participated in a variety of other 
meetings. As part of this outreach program, NPPD and ISCD has regularly updated impacted 
sectors through their Sector Coordinating Councils and the Government Coordinating Councils - 
including the Chemical, Oil and Natural Gas, and Food and Agriculture Sectors. In addition, 
ISCD continues to focus on fostering solid working relationships with state and local officials 
including first responders. 

NPPD and ISCD continue to collaborate within DHS and with other federal agencies in the area 
of chemical security, including routine engagement with USCG; TSA; the Department of 
Justice's Federal Bureau of Investigation and Bureau of Alcohol, Tobacco, Firearms and 
Explosives; the NRC; and EPA. 

Across the Nation, ISCD’s Chemical Security Inspectors have been actively working with 
facilities and governmental agencies. Collectively, they have participated in more than 4,050 
meetings with federal, state, and local officials, conducted over 1,060 Compliance Assistance 
Visits, and have held more than 4,240 informal introductory meetings with owners and/or 
operators of CFATS-regulated facilities. 

To promote information sharing, ISCD has developed several communication tools for 
stakeholder use, including: the Chemical Security website f www.DHS.gov/chemicalsecuritv~l : a 
Help Desk for CFATS-related questions; a CFATS tip-line for anonymous chemical security 
reporting; and CFATS-Share, a web-based information-sharing portal that provides certain 
federal, state, and local agencies access to key details on CFATS facility information as needed. 

Highlights and Successes of CFATS Program 

As we have previously discussed, the ISCD Action Plan currently contains 95 items, each of 
which has been assigned to a member of ISCD’s senior leadership team for implementation. As 
of September 1 1, 68 of the 95 action items contained in the Action Plan have been completed. 

For accountability, planning, and tracking purposes, the members of that leadership team have 
established milestones and a schedule for the completion of each task assigned to them. In 
addition, ISCD leadership meets with me at least once per week to provide status updates on the 
action items and discuss ways that NPPD leadership can help. 

I would like to share with the Subcommittee some of the highlights and successes that are a 
direct result of the implementation of the Action Plan and other recent initiatives performed by 
ISCD. These include: improving the SSP review process and increasing the pace of SSP 
reviews; refining inspector tools and training; reinvigorating industry engagement on their 
development of ASP templates; improving internal communications and organizational culture; 
and preparing for an external peer review of the CFATS risk assessment methodology. 

SSP Review Process. ISCD is currently utilizing a refined approach for reviewing SSPs in order 
to move forward in a more efficient and timely fashion. At this time, ISCD has completed its 
initial review of ail Tier 1 SSPs and has begun reviewing Tier 2 SSPs. As of September 1 1 , 

2012, of the Tier 1 SSPs reviewed, the Department has authorized or conditionally authorized 
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SSPs for 73 facilities. Of the remaining Tier 1 SSPs reviewed by the Department, we are either 
validating results or reaching out to these facilities to obtain additional information or action in 
the hope of resolving the outstanding issues affecting their SSPs. White the interim approach for 
SSP reviews is underway, ISCD will continue to work to improve the long-term approach to the 
SSP review process. As of September 17, 2012, DHS has approved the SSPs for two Tier 1 
facilities. 

Inspections. In September 2011, ISCD estabhshed an Inspector Tools Working Group to ensure 
the Chemical Security Inspectors have up-to-date and, where appropriate, improved inspections 
procedures, policies, equipment, and guidance. In June 2012, ISCD finished updating its internal 
inspections policy and guidance materials for inspectors. ISCD also began providing additional 
training that focuses on the updated policy and guidance materials to prepare Chemical Security 
Inspectors to resume authorization inspections at facilities with authorized or conditionally 
authorized SSPs. As a result, I am pleased to announce that as of July 16, 2012, ISCD has 
resumed authorization inspections at Tier 1 facilities. This is a vital step for moving the CFATS 
program toward a regular cycle of approving SSPs and conducting compliance inspections for 
facilities with approved SSPs. 

Alternative Security Programs (ASPs). Many members of the regulated community and their 
representative industry associations have expressed interest in exploring ways to use the ASP 
provisions of the CFATS regulation to streamline the security plan submission and review 
process. In support of this, ISCD has been holding vigorous discussions with industry 
stakeholders in regard to their development and submission of ASPs. One particularly promising 
effort has been ISCD’s engagement with the American Chemistry Council (ACC) in support of 
its efforts to develop an ASP template for use by interested members of its organization. In 
August 2012, the ACC piloted the ASP template in Michigan ASPs submitted by facilities using 
the ACC template will be reviewed under the same standards that ISCD currently reviews SSPs, 
but the use of ASP templates may streamline both the plan development and plan review 
processes. Additionally, DHS continues to review existing industry programs, such as ACC 
Responsible Care® and SOCMA ChemStewards®, to identify potential areas of engagement and 
further discussion. 

Internal Communications and Employee Morale. The Action Plan contains a number of items 
designed to improve internal communications and morale within ISCD. ISCD has implemented 
many of these action items and has made significant progress on many others. For instance, 
ISCD employees now contribute to and receive a monthly ISCD newsletter, which covers a wide 
variety of both field and headquarters activities. ISCD leadership has promoted staff 
engagement and a dialogue about issues and concerns through monthly town halls and a senior 
leadership open-door policy. ISCD staff has a standing invitation to participate in group open- 
door sessions or to schedule one-on-one discussions with Division leadership. 

ISCD is also moving forward with issuing vacancy announcements to hire a permanent 
leadership team; several announcements have already been posted and several others are nearing 
posting. Supervisors have been provided with additional supervisory training and guidance on 
performance monitoring. The Division has developed a mission statement, vision statement, and 
core values. As a result of these and other efforts, I believe that Division-wide morale is 


6 



85 


improving, which ultimately will pay dividends not only in improved staff retention, but also in 
improved staff performance and program execution. 

Risk Assessment Methodology Review. In light of prior revisions to the S VA risk assessment 
computer program for chemical facilities, NPPD has committed to doing a thorough review of 
the risk assessment process and keeping the Subcommittee apprised of any significant issues 
related to that review. In support of this, NPPD developed a three-phased approach, which is 
captured in the Action Plan and includes: documenting all processes and procedures relating to 
the risk assessment methodology; conducting an internal DHS review of the risk assessment 
process; and initiating an external peer review of the risk assessment methodology. The 
Division has made significant progress on this action item by completing the first two steps. 
Procurement actions for the external peer review have been completed as of September 1 1 , 20 1 2, 
which is expected to begin before the end of FY12. 

NPPD remains committed to both developing appropriate responses to any risk assessment issues 
that it identifies and keeping Congress and stakeholders apprised of any significant issues related 
to that review. 

ISCD Budget Priorities for FY13 

The President’s Budget for FY 2013 requested $74,544 million for the Infrastructure Security 
Compliance Program, including funds for 253 full-time positions/242 full-time equivalents 
(FTE). The primary initiatives under Infrastructure Security Compliance are the implementation 
of the CFATS Program and the development and implementation of the proposed Ammonium 
Nitrate Security Program. In helping to develop the President’s Budget, DHS considered as its 
top priority the retention of basic CFATS functionality. Accordingly, DHS prioritized its 
funding request to enable DHS to thoroughly and expediently review SSPs of CFATS-covered 
facilities that pose the highest level of risk to ensure that such facilities’ security measures meet 
applicable risk-based performance standards and to expedite the performance of inspections at 
those facilities. 

The FY 2013 DHS Appropriations bill that was approved by this Subcommittee would provide 
$45.4 million for the Infrastructure Security Compliance Program. This represents a decrease of 
$47,908 million from the FY 2012 enacted level of $93,348 million, and is $29.1 million less 
than the President’s Budget. 

An appropriation of $45.4 million would drastically curtail DHS’s ability to: 1) implement the 
statutory and regulatory requirements for the security of high-risk chemical facilities as specified 
in CFATS; 2) continue development of the proposed Ammonium Nitrate Security Program; and 
3) fully implement the program improvements identified in the ISCD Action Plan. DHS 
estimates that, after expending approximately $35 million for salaries and benefits for 242 FTEs, 
approximately $12 million would remain for implementing CFATS and completing development 
of the proposed Ammonium Nitrate Security Program. DHS would be forced to cease virtually 
all activities under CFATS other than those directly related to reviewing SSPs and performing 
facility inspections which means those other activities would be significantly delayed. At the 
proposed $45.4 million funding level, the Department’s ability to conduct the most basic CFATS 
functions would be impacted. These include maintaining the CSAT and the Chemical-Security 
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Management System (CHEMS) information technology (IT) systems, and acquiring important 
technical and subject-matter support. Additionally, CFATS-related outreach and engagement 
with the regulated community would be significantly reduced and some aspects would cease; 
development and implementation of the proposed Ammonium Nitrate Security Program would 
be significantly delayed; and many of the managerial improvements outlined in the ISCD Action 
Plan may be delayed or negatively impacted. 

Legislation to Permanently Authorize CFATS 

DHS recognizes the significant work that the Subcommittee and others have accomplished to 
reauthorize the CFATS program. The Department supports a permanent authorization for the 
CFATS program and is committed to working with Congress and other security partners to 
establish a permanent authority for the CFATS program in federal law. We appreciate this effort 
and look forward to continuing engagement with Congress on these important matters. 

Conclusion 

ISCD, NPPD, and the Department are moving forward quickly and strategically to address the 
challenges before us. CFATS is reducing the risks associated with our Nation’s chemical 
infrastructure. We believe that CFATS is making the Nation safer and are dedicated to its 
success. As we implement CFATS, we will continue to work with stakeholders to get the job 
done, meet the challenges identified in the ISCD report, and execute a program to help prevent 
terrorists from exploiting chemicals or chemical facilities. 

Thank you for holding this important hearing. 1 would be happy to respond to any questions you 
may have. 
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SITE SECURITY PLANS: APPROVALS/AUTHORIZATIONS 

Ms. Spaulding. Yes, I can, Mr. Chairman. Thank you for the 
question. We actually have now authorized 84 of the site security 
plans, and that includes 12 tier 2s. We have completed our review 
of all the tier 1 plans. And those that we have not been able to au- 
thorize, we are going back to the facilities to work with them to get 
those plans into shape so that we can move forward with those au- 
thorizations and the authorization inspections. But in the mean- 
time, we have gone on to tier 2s, and we have reviewed about 40 
percent of the tier 2 site security plans. And as I say, we have au- 
thorized 12 of those. 

The next step, as you know, is authorization inspections, and we 
have conducted 22 authorization inspections. And two of those have 
been able to move all the way through to approval. So we have two 
site security plans that have gone through the entire process to be 
approved. And so that is an increase of about 21 authorizations 
just since our July hearing. 

Mr. Aderholt. When I was talking to Mr. Caldwell earlier, we 
talked about the use of performance metrics. Authorizing and ap- 
proving a site security plan is a perfect example of a metric that 
shows you are moving forward. Why has there been a delay in the 
authorizing plans, and when will NPPD actually approve a site se- 
curity plan? 

Ms. Spaulding. So we have approved two site security plans, 
and we are certainly hopeful that we have turned the corner on 
this. We now have trained our inspectors in our refined authoriza- 
tion inspection process. We have trained all of our inspectors this 
summer, and they are now going through all of those plans that 
we have authorized, 84 of them, to conduct the appropriate inspec- 
tion to make sure that the plan that is on paper is really something 
that the facility is in a position to implement, get the ground truth 
there. And as I say, they have done 22 of those inspections so far, 
and we have got a number of them scheduled, and David can give 
us the details on what is in the near term. But we are moving 
through to get those inspections done, which have to happen before 
we can then approve the plan. 

Mr. Aderholt. When do you estimate that all 114 of the security 
plans will be not only authorized but approved and inspected? 

Ms. Spaulding. So approval of a plan or authorization of a plan, 
the timing of that it is not entirely within our control. As I say, 
we have reviewed all the tier 1 site security plans, but some of 
them need some work. And so it really is dependent on the com- 
pany, the facility, to work with us to make sure that the informa- 
tion that is needed is there and that it is clearly presented. And 
so we are hopeful that we are — as I say, we are reaching out to 
those facilities now. We are hopeful that we will resolve those 
issues and be able to move them into the authorized column, and 
we are moving forward on inspections. 

David, I know we are really loathe to set any rigid timelines, 
again, given that much of this depends on interaction between us 
and the facilities, but if you would like to address it. 

Mr. WULF. I could take a crack at it. 
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We are working very closely with those facilities that remain to 
he authorized. And our goal, clearly, is to work to get those facili- 
ties to approval. So we are anticipating a significantly heightened 
pace of authorizations and facility inspections, and we hope approv- 
als as well within the next year. We certainly anticipate, if every- 
thing falls into place with the facilities having been inspected and, 
if everything lines up, approving all of the tier 1 facilities and quite 
a number of tier 2s as well. 

Mr. Aderholt. Do you have a ball park guess as far as when all 
114 will be authorized, approved and inspected? 

Mr. WULF. Certainly our goal is to have that done before this 
time next year, but probably significantly before. We have a goal 
of doing just under 300 approvals in fiscal year 2013, so that would 
include, if everything lines up, all of the tier Is and a good chunk, 
close to half, of the tier 2 facilities. 

Mr. Aderholt. Mr. Caldwell, I know GAO says it may be 2020 
before all sites are authorized, approved and inspected. Do you 
stand by that? 

Mr. Caldwell. This is an estimate we came up talking with the 
staff at NPPD and the directors. Director Wulf, so this is some- 
thing they are going to have a little more expertise on until we get 
a little more into it on our phase 2 of our review of this. I think 
the key thing will be getting some of these under your belt, finding 
out how long they take, perhaps finding ways to streamline those. 
And then there is just obviously going to be a backlog. And until 
they start to figure out how long it is going to take them to start 
clearing the backlog of other ones, it is going to be hard to come 
up with a hard estimate for that. 

Mr. Aderholt. Mr. Price. 

SITE SECURITY PLANS: APPROVAL PROCESS LESSONS LEARNED 

Mr. Price. Thank you, Mr. Chairman. 

We are, of course, pleased to get the update on your progress, the 
completion of the tier 1 approvals and now getting into the tier 2 
category. I wonder if you could, in light of the chairman’s line of 
questioning, just step back a minute and reflect on lessons learned. 
Obviously, we have had here a very complex and protracted rule- 
making process. Then the inspections and the extra work in the 
field is also often complicated and time consuming. At the same 
time, your efforts have taken much longer to complete than some 
other agencies, like the Coast Guard, that have been mandated to 
complete equally complex rulemaking. 

So, Ms. Spaulding, I wonder if, in retrospect, there are specific 
things you think should have been done differently to make the 
process more streamlined and more efficient from the start? And of 
course, I am interested in any implications those reflections have 
for the process going forward. We, of course, don’t have 7 to 10 
years to complete these inspections. And so that is a question that 
isn’t just retrospective but also has present day implications. 

And then, Mr. Caldwell, maybe you can chime in what, from your 
point of view, would be the key factors that have contributed to the 
difficulties here and implications for the program going forward? 

Ms. Spaulding. Thank you. 
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Hindsight is a wonderful thing, and it is relatively easy at this 
stage to look back and to see where decision points were, where 
you wished that we had gone in a different direction or moved in 
a different way. I do think it is important to remember that it was, 
in many respects, an unprecedented regulatory regime that we 
were asked, the department was asked to undertake. It was, you 
know, in an industry where we did not have in the department es- 
tablished contacts the way the Coast Guard has many, many, many 
years of experience of interaction with the facilities at the ports. 
And so we had to start by developing a regulatory regime around 
performance-based standards, which is much more complicated 
than one where you tell everybody they have to have a 12-foot 
fence, for example, to come up with standards that are, and I think 
Congress imposed on us, the requirement to be performance-based, 
and I think that is the right decision, but it makes it more chal- 
lenging for both the facilities and for the department. 

We then had to find the chemical facilities, the wide variety of 
facilities that are covered by CFATS that includes universities and 
hospital and warehouse distributors in addition to chemical manu- 
facturing plants, so a significantly wider variety of facilities; iden- 
tify those, get the word out about this requirement; build the tools, 
the IT tools to allow us to get the data, then to take in 41,000 top 
screens, 41,000 facilities about whom we now have data with re- 
gard to their holdings of dangerous chemicals. And we had to de- 
velop that list. There was no set list out there of what were those 
chemicals. So we developed that list. We now have data that we 
did not have before on 41,000 facilities all across the country. 

We had to develop what a vulnerability assessment for a chem- 
ical facility would look like, again, in a wide variety of facilities and 
develop the tools to allow those facilities to provide that informa- 
tion to us and 8,000, nearly 8,000 facilities went through that im- 
portant process of analyzing their vulnerabilities. 

We then had to develop a template or guidance on the site secu- 
rity plan and the tools to get that in. And we have received more 
than 4,500 — 4,500 — site security plans, where facilities went 
through the careful process of developing that detailed, perform- 
ance-based security plan. So we really did accomplish a great deal, 
but it was very complex. And until we got into it, it was hard to 
know exactly what the role, for example, of chemical inspectors 
would be. And initially there was a thought that they might have 
a response role, a first responder kind of role. As we got into it and 
talked with industry, and were able to look at the compliance and 
talk to other compliance and regulatory agencies, the determina- 
tion was made that that was actually not going to be part of their 
role, but all of these things have taken time. 

An important lesson I think that I certainly have taken away 
from looking back at what has happened is the need to continue 
frequent, constant interaction with the industry. I think in the 
early stages, there was good interaction. We went through a phase 
where I think we were kind of hunkered down trying to figure out 
our regulatory regime and maybe the contact wasn’t quite as good 
it as should be. And I think Director Wulf and Director Anderson, 
when she was here, have done an outstanding job, and I have 
worked hard at trying to do better outreach with the industry. And 
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that is vitally important. They have expertise that we cannot rep- 
licate in the government. And so hearing from them and under- 
standing the challenges that they face is critically important. 

Mr. Price. Mr. Caldwell. 

Mr. Caldwell. As you said, there are some similarities between 
this and the Coast Guard regime, CBP, TSA and some of the other 
elements at DHS. I think those were put into place relatively 
quickly, but as you know, and I think, as we all know, the Coast 
Guard, and CBP, and to a lesser extent TSA, they had established 
authorities. They had established organizational structure. And 
then maybe one of the most important things here is they actually 
had a field structure, which included a cadre of inspectors that you 
actually had. So they had people called inspectors that did that; 
they were inspecting for safety. You could train them, and you had 
these people already to train them for security. 

Again, in some ways, at least the Coast Guard regime under 
MTSA is performance-based; it is not a specific standard generally. 
I think one of the approaches the Coast Guard took, and that is 
some of the work I am most familiar with, is kind of an implement 
and amend approach. It is like let’s get this out there, and we are 
not going to make it perfect. And I think maybe because the new- 
ness of NPPD and the CFATS regime, there has been a little more 
deliberation. I think they got off to a fast start. I mean the rule 
was in place and the appendix by the end of 2007, and that is 
where I think they started to struggle with the other issues about 
how are we going to organize this, and what are these people going 
to look like, these inspectors and things like that. 

I think the biggest challenges moving forward is twofold: One, 
kind of they are making progress on this regulatory regime, but 
they are also having to deal with the memo and the management 
problems that go with that. I also think that this backlog will soon 
become another issue; once they get those things in place, the back- 
log will become a bigger issue. And the, of course, you are faced 
with the do you surge staff that you are not going to need for the 
long run in terms of inspectors or you just get a strategy to kind 
of work that down. In some ways, it is very similar to the C-TPAT 
program that CBP had when they first set up, because you had a 
large backlog that they eventually threw 150 people at and got 
through it that way. 

Mr. Price. Thank you. 

Mr. Aderholt. Mr. Carter. 

PERSONNEL SECURITY CREDENTIALING PROGRAM 

Mr. Carter. Thank you, Mr. Chairman. 

And welcome, thank you for being here. This is an important 
issue. 

Back in 1969, I was a young lawyer who chaired or actually 
staffed a Houston ship channel study committee on safety. I heard 
some testimony from the Coast Guard at that time that at least 
once a day and sometimes as many times as five times a day, two 
chemical-carrying ships passed each other within 8 feet of each 
other; and should there be a collision of those ships, an explosion 
would result, and the prevailing winds and plume of poisonous gas 
that would come from that explosion would kill every man, woman 
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and child on the Texas Gulf Coast from Houston to Corpus Christi. 
That was about as serious a thing as I had ever heard of in my 
life. And so I think you have one of the most serious duties that 
we have under this particular agency. 

And I want to ask you about something that has been brought 
to my attention. We are fighting a war against people who individ- 
ually blow things up. So personnel safety is a key factor in any fa- 
cility, big or small, wherever it is; are people entering this facility 
that are safe? This key component that these chemical companies 
have sophisticated background check programs. Verifications 
against the terrorist screening database is inherently a govern- 
mental function. We see that DHS has pulled back its proposal 
from the 0MB. What has DHS learned from the companies, from 
comments from industries on your initial proposals? Will the DHS 
include better leveraging of TWIG and other existing vetting pro- 
grams to ease the burden on the regulated community while ensur- 
ing that workers are properly vetted? What is the time timetable 
for the revisal of the proposal so that industry can begin to submit 
information on those not yet vetted? How will the proposed per- 
sonnel safety program improve security since its focus is on react- 
ing to an instant instead of preventing one? And finally, given the 
apparent push by DHS to create a whole new personnel security 
credentialing program as opposed to leveraging the existing 
credentialing program, would such a policy decision create an oner- 
ous and unnecessary financial burden on CFATS regulated commu- 
nity? Would such a duplicative effort run counter to the President’s 
call for the reduction and elimination of duplicative and burden- 
some regulations for our Nation’s business? In other words, I want 
to know how we are going to get serious about vetting these people, 
and those are questions that need to be answered. 

Ms. Spaulding. Thank you. Congressman. They are very impor- 
tant questions. This is an absolutely essential issue. 

We withdrew our information collection request from 0MB be- 
cause we had learned from industry, and we thought it was really 
the fastest way to move forward to get a program actually imple- 
mented, because, as you know, the process really limits our ability 
to have really granular conversations with industry and with Con- 
gress, and we wanted to have both. 

Some of the things that we have learned, we have already had 
a number of meetings. I have participated in one already since we 
pulled the information collection request and have another one 
scheduled for tomorrow, and the director has done a number of 
them, as have others. We have been really trying to work with in- 
dustry to address some industry concerns. And some of those issues 
that I think we can address that go to the burden but that still 
meet our national security imperative are things like allowing com- 
panies to file the information about their employees on a company- 
wide basis as opposed to facility by facility, so that if you have folks 
who are traveling from one facility to another, you don’t have as 
high a burden there. 

The ability for contractors to file, I think, was in our original pro- 
posal but was not well understood, that facilities and companies 
could make it part of their contractual relationship with their con- 
tractors that the contracting company would file the information 
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with regard to their employees, rather than having the chemical 
company have to do that for them. And then finally we have heard 
a lot about the need to find better ways to leverage TWIG, and we 
have worked hard to find a way to do that that again meets our 
national security imperative. And I think we actually can do that. 
I think we have had some very productive conversations with in- 
dustry about ways in which we can, with electronically verified 
TWIG [Transportation Worker Identification Gredential] cards, find 
a way to have that meet the criteria for personnel surety under 
GFATS. 

And we have been talking and are mindful about the different 
position that small facilities are in versus large companies that 
have multiple facilities. And we, again, have thought hard about 
ways and have some, I think, constructive suggestions for ways in 
which we can mitigate the burden even for small facilities. So I am 
very optimistic, and I think our hope and expectation is that cer- 
tainly maybe by the end of fall, within the next couple of months, 
we will be ready to resubmit and move I hope quickly through that 
process to have a program in place. 

David. 

Mr. WuLF. I don’t think I would add anything to that. 

Mr. Garter. I appreciate that answer. What would be the turn 
around time if this information is submitted, because the company, 
if I understand what you said, you are setting up a program where 
the companies can submit their personnel and then you will proc- 
ess them through to see whether or not they are a danger to our 
country and to that facility; is that what you are saying? 

Mr. WuLF. That is the essence of the program. 

Mr. Garter. Because I don’t know how long you have been in ex- 
istence in this project, but I assume about as long as DHS has been 
in existence, and we still have got a lot of questions. So my ques- 
tion on this particular one would be, what would be the turnaround 
time when they submit it to you? When will you be able to say, 
your people are okay? Will it be days, weeks, months, years? 

Mr. WULF. And — yeah, we will not necessarily be in a position 
to tell a facility “go” or “no go.” The requirement would only be, as 
sort of conceived — and we are having, I think, productive discus- 
sions on this and will continue to have productive discussions be- 
cause we do want to get this right — ^but as initially conceived the 
idea was that facilities or their contractors, third parties, would 
submit information either for direct vetting against the terrorist 
screening database or to leverage existing vetting about 48 hours, 
up to 48 hours before the planned access to the high-risk facility. 
So that is sort of about the turnaround time we would have. 

Mr. Garter. Okay, that answers my question. 

Mr. Aderholt. Mr. Latham. 

Mr. Latham. Thank you very much, Mr. Ghairman. 

And welcome, everyone here. 

Mr. Galdwell, it has been said that part of the problem with the 
GFATS program is that it started too quickly without a lot of 
thought as to its direction and that many of those involved in the 
program do not have the expertise to carry out the mission of the 
program. Would you agree with that theory? And if so, why or why 
not? 
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Mr. Caldwell. I think one of the things that NPPD’s own memo 
or ISCD’s own internal memo pointed out was that those people 
were brought on very quickly when it was a little unclear what 
skills they actual have. And some of them had skills that were 
more toward law enforcement than regulatory inspections. I think 
with the training they have had this summer of their folks, that 
a lot of that problem hopefully will go away. 

There are some areas that will probably still be problematic in 
terms of expertise. The cybersecurity area, for example, they have 
people who review the plans specialize in that area. And that is 
kind of a high demand area right now for I think reasons we all 
know because of that threat. 

Mr. Latham. Are there any internal department barriers to real- 
ly prevent the hiring of properly qualified people to carry out the 
program, and what kind of barriers would they be? 

Mr. Caldwell. I think one of the larger barriers to that was re- 
solved a few years ago when the authority to hire was delegated 
from the department down to NPPD, and we did find some — the 
memo talks about some disconnects between NPPD and ISCD, but 
in our recent work over the last several months, we found a rel- 
atively close working relationship, and we meet on a very regular 
basis to try to get through that. Now if they end up having some 
people that, you know, aren’t qualified and can’t be qualified for 
some reason, that is another issue that I am not sure quite how 
they will deal with. 

Mr. Latham. Are there issues as far as training capability to get 
people up to being qualified? What do you find in that regard as 
far as training capabilities? 

Mr. Caldwell. We are just starting our phase 2 looking more at 
kind of the mission and the actual inspections and things like that 
of the program. But obviously training is one thing; it is actually 
getting people out there and having them inspect facilities and get 
several facilities under their belt will make the biggest difference 
in the department. And NPPD will start dealing with getting a lot 
of these inspections done and getting the backlog taken care of 

HIRING QUALIFICATIONS 

Mr. Latham. Okay. 

Ms. Spaulding, kind of on the same line of questioning, I think 
you are aware that there have been problems getting qualified peo- 
ple on board to carry out the mission. To what do you attribute the 
difficulty in getting qualified people? 

Ms. Spaulding. I think a clarification — and I will let David, who 
was one of the co-authors of that memo, speak to it — but what they 
have done is to look at folks’ qualifications and make sure that 
they are in the right job, a job that suits those qualifications. And 
so some of that has been an issue of realigning folks and making 
sure that they are in a position that, as I say, suits their skills and 
their training. 

There has been stepped up training and, particularly, I would 
emphasize, on leadership. We have stepped up NPPD-wide our 
focus on making sure that our supervisors have appropriate leader- 
ship training so that they are better suited to step into those lead- 
ership positions, and that has been very important. 
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Mr. Latham. Mr. Wulf. 

Mr. Wulf. I would only add to that that the Deputy Under Sec- 
retary is absolutely right. We have done some good training on 
leadership that will provide people with — our folks with the tools 
to step into management roles. We this summer did some great 
training on inspections to ready ourselves to recommence author- 
ization inspections, which we were able to do in July. 

With regard to the skills of the, the talent of the folks within our 
division, I don’t think I can overstate the level of passion and tal- 
ent that our people bring to the job. And they have certainly come 
in from a variety of backgrounds, law enforcement, military, indus- 
try backgrounds. And I think all have brought valuable skills to 
the table. In some cases, we have had to do some tweaking through 
realignment to get better person-position fits, but I think, through 
the training we have done, we have taken — through the policies we 
have put in place, we have made great strides in coming together 
as a cohesive regulatory compliance organization. So I am very 
pleased with the progress we have made and again can’t say 
enough about the talent of the folks we have on the team. 

Mr. Latham. What you just said, does that go along with Rand 
Beers’ report, that as far as capabilities and expertise, the inter- 
nal — 

Mr. Wulf. If we are talking about the report, the challenges 
memo that Director Anderson and I sent up to tinder Secretary 
Beers, yeah, it addresses what we discussed in the report. The con- 
text for those statements was that we needed to do a better job of 
ensuring a proper fit between the people with the skill sets that 
we brought on board and the actual alignment to the mission at 
hand. So I think we have made significant strides moving forward 
in that regard over the past year. 

Mr. Aderholt. Mr. Dent. 

SITE SECURITY PLANS: NUMBER OF COMPLETED REVIEWS 

Mr. Dent. Thank you, Mr. Chairman. 

Good morning. Just a few things I want to follow up on Judge 
Carter’s question, but before I do, just with respect to the site secu- 
rity plans and that whole review process on page 5 of the testi- 
mony, you said, I think, Ms. Spaulding, you said you completed all 
initial reviews of the tier 1 site security plans. How many is that, 
all of them? 

Ms. Spaulding. One hundred and fourteen. 

Mr. Dent. One hundred and fourteen. And 73 have been author- 
ized or conditionally authorized. 

Ms. Spaulding. We are up to 84 total authorizations, but that 
includes 12 that are tier 2s. 

Mr. Dent. Okay. And then I guess two site security plans have 
been approved or completed then. 

Ms. Spaulding. Correct. 

SITE SECURITY PLANS: TIME FRAME EOR REVIEWS 

Mr. Dent. What is the timing of that? You may have already 
stated it, but what would be the timing then to get from those con- 
ditional authorizations or authorizations to an approval? 
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Ms. Spaulding. So the next step after their conditional author- 
ization is to schedule an authorization inspection and get the in- 
spectors in there to inspect the facilities. The length of time that 
that inspection takes depends, of course, on the complexity and size 
of the facility. And then depending on what they find when they 
go in will dictate how quickly we can move to approval. 

The two that have been approved, do we have an estimate of how 
long or the 22 inspections that have been undertaken, David, 
maybe you can suggest an average time that that has taken? 

Mr. WULF. I would anticipate a time frame of 2 to 3 months, not 
that there is a cookie cutter, but as the Deputy Under Secretary 
mentioned, there is a period of time for the drafting of the inspec- 
tion report, for the review of the inspection report. Occasionally, 
there is a period during which the site security plan tool is re- 
opened for the facility to make adjustments to the site security 
plan on the basis of the findings of the inspection. 

So all that would hopefully get us to a position where we are able 
to approve a plan within 2 to 3 months after the inspection. 

Mr. Dent. And you can do all these simultaneously? All the — 2 
minus 110 to go. In other words, you have to do — about 108 sites 
have to get completed. Just curious, how long do you think you will 
be able to finish the whole queue? 

Mr. WuLF. Of tier Is? 

Mr. Dent. Yes, tier Is. 

Mr. WuLF. I am pretty confident we will be able to get through 
these in the next 6 to 8 months. 

PERSONNEL SURETY PROGRAM 

Mr. Dent. Okay. On the issue of the Personnel Surety Program, 
which, Ms. Spaulding, you began, you started to address with 
Judge Carter’s question. First, I think withdrawing that controver- 
sial information collection request, the ICR from 0MB, is a good 
step forward for CFATS leadership in terms of recognizing the in- 
dustry and stakeholder input into this whole process. 

I know the level of engagement with industry is still an issue of 
some concern. I am interested in how you plan to work with the 
interested parties to develop a rewrite of the ICR. How many meet- 
ings have you had thus far or are planning to have with industry 
since withdrawing the previous proposal? 

Maybe that should be a question of Mr. Wulf 

Mr. Wulf. We have had two at this point. I think tomorrow will 
be a third. We were anticipating a fourth next week. That is being 
rescheduled, in view of a couple of conflicts, for the second week of 
October. So we are probably anticipating two to three additional 
meetings before we look to resubmit. 

Mr. Dent. And you think you will be able to take into account 
their concerns as you put together this new proposal? 

Mr. Wulf. That is absolutely the goal. 

Mr. Dent. Okay, good. When do you think we are going to see 
a new proposal? Do you have any idea on timing? 

Mr. Wulf. We are aiming for this fall, so the October, November, 
early December time frame. We would like to get it up there as 
soon as we possibly can. 
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TRANSPORTATION WORKER IDENTIFICATION CREDENTIAL: 

INCORPORATION INTO PROCESS 

Mr. Dent. How are you going to plan to incorporate TWIG into 
the credentialing framework? 

Mr. WULF. As the Deputy Under Secretary mentioned, that is 
one of the things, one the areas in which our thinking has evolved 
significantly as a result of the input we received from industry. So 
we believe that we will be able to leverage to the fullest extent pos- 
sible vetting already done through TWICs to allow for the elec- 
tronic verification of TWIG at a facility site or elsewhere, perhaps. 
So we are looking at how we can most fully take advantage. 

Mr. Dent. Are you looking at other credentials, FAST as well as 
TWIG, as part of that credentialing process. 

Mr. WuLF. We will be looking at everything down the road. And 
to the extent we can do that this time around, we will, but we are 
focusing on TWIG. 

Mr. Dent. Okay, good. What will the reporting requirement back 
at DHS for a facility for individuals using a TWIG? 

Mr. WULF. You mean upon verification? 

Mr. Dent. Yes. 

Mr. WULF. That is one of the things we need to work through. 
I don’t know that there will be a requirement for facilities to report 
back, but we would like to explore ways that we can verify that 
electronic verification has occurred without imposing unnecessary 
burdens on industry. 

Mr. Dent. And what do you anticipate facilities’ obligation for re- 
porting would be for those without a TWIG? 

Mr. WuLF. Well, for those without a TWIG, for whom we are not 
leveraging other sorts of vetting, I think what we would be looking 
at is the reporting of the — or the submission of personal identifying 
information, you know, prior to 48 hours before the planned access, 
and that can happen on a companywide basis. It could happen di- 
rectly, through third parties. So we would like to provide as many 
options as we possibly can to industry on this. 

Mr. Dent. Thank you. 

I yield back. 

INTERNAL REVIEW MEMO 

Mr. Aderholt. Thank you, Mr. Dent. 

Let me just talk a little bit about the internal review memo. I 
know that, or I understand that, NPPD decided to limit the dis- 
tribution of the memo to the extent that only senior leaders would 
receive the full version of that internal review memo. I would di- 
rect this to Mr. Galdwell. Do you believe the limited distribution 
of the memo hindered the execution of the action plan? 

Mr. Galdwell. Ultimately, I don’t think it did. I think in some 
ways, that is a judgment call that management has to make. We 
are going to come clean; these are all the problems we have, but 
did you believe that some of the information in there was sensitive 
about the program, so the more that you distribute among your 
personnel, the more of chance that information could get out. 

We did find — initially we were concerned because people that 
were responsible for some of the actions in the action plan did not 
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have access to the memo, but on further discussions with them, 
they had had detailed discussions with Ms. Anderson and I assume 
Mr. Wulf about what they saw as the nature of the problem and 
what needed to be fixed there. 

Mr. Aderholt. Thank you. 

Secretary Spaulding, why was the internal memo so closely 
guarded? What was the thinking there, especially when members 
and officials representing the industry hadn’t seen this assess- 
ment? 

Ms. Spaulding. We had not provided it to folks in the industry, 
and we are frankly disappointed that the memo got as widely dis- 
tributed as it did. I think this was clearly a very candid, internal 
memorandum that was written by our new leadership then at 
CFATS for the Under Secretary. And I think it is absolutely vital 
that that kind of confidential communication be allowed to take 
place, really no holds barred, warts and all, and frankly, not writ- 
ten as carefully or as thoughtfully as you would if you were writing 
it for a broader audience, written with the understanding that this 
was a prelude to a conversation to sit down and talk through the 
issues with the Under Secretary. And so I think to keep faith with 
the authors of the report and, frankly, with the workforce, I think 
it was the right decision to hold that close and try to avoid having 
that memo have broad distribution. It was not written with that 
in mind. It would have been written in a different way had that 
been the intended outcome. 

And frankly, I think it is not helpful for the workforce to be fo- 
cused on the word choice within that kind of an internal memo 
rather than on moving forward with the mission. And the action 
plan was made widely available to the folks at ISCD and, again, 
the opportunity to talk through the challenges and problems that 
led to the creation of that action plan. 

PUBLIC-PRIVATE PARTNERSHIPS: OUTREACH TO INDUSTRY 

Mr. Aderholt. Thank you. 

We have heard from industry, and I know in your comments ear- 
lier, you mention about hearing from industry, but we have heard 
from industry that the Department of Homeland Security has not 
fully developed or utilized the public-private partnerships and in 
fact has stepped back from previous partnerships. These partner- 
ships are crucial in the implementation of this program, particu- 
larly in the current fiscally constrained environment. Industry, like 
government, does not want harmful chemicals in the hands of ter- 
rorists, and that is clear. Has the Department of Homeland Secu- 
rity stopped promoting or building partnerships between DHS and 
facilities it regulates? 

Ms. Spaulding. Absolutely not. And I can speak personally, since 
I came on board last fall, I have participated in numerous meetings 
with industry. I have gone on a number of occasions to the Chem- 
ical Sector Coordinating Council meetings, the recent Chemical Se- 
curity Summit, which is put on by industry. We had the Under 
Secretary. I spoke. Director Wulf spoke. We had a number of folks 
from ISCD who participated in numerous panels. I have sat down, 
I have also gone to the American Chemistry Council annual meet- 
ing, to the oil and natural gas gathering. We have sat down with 
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industry on personnel surety and a number of other issues. I think, 
as I said, I think there was a period of time when there was a focus 
on doing the work, and the outreach to the industry was not what 
it might have been, but I think, within the last — over the last year 
with the new leadership at CFATS, I would be surprised if indus- 
try does not feel as though we have been reaching out to it. 

Mr. Aderholt. But in the past, you feel like there was some dis- 
couragement? 

Ms. Spaulding. I don’t think there was any discouraging of out- 
reach to industry; I am not aware of that. As I say, I think there 
was a period of time when there was a real focus on trying to get 
the program implemented properly, where they had done a good 
deal of outreach to industry and now they were trying to focus in- 
ternally and get the program implemented. And the lesson learned, 
as I said earlier, is that that outreach has to continue on a very 
constant and regular basis. 

Mr. Aderholt. So building and forming those partnerships with 
the regulated CFATS community is vitally important? 

Ms. Spaulding. Absolutely essential. 

Mr. Aderholt. Thank you. 

Mr. Price. 

funding: proposed cuts’ impact 

Mr. Price. I think it might be useful at this point in the hearing 
to turn the tables a bit. We have been talking about your responsi- 
bility, your plans. Let’s talk about our own and about the work of 
this subcommittee and the way it will most surely affect your abil- 
ity to carry out the plans that you have projected. We, after all, 
have some responsibilities, too. 

The fiscal 2013 request for the Infrastructure Security Compli- 
ance Division was $74 million. The House-passed bill provides 
$45.4 million, nearly 40 percent less than the request. Yet this divi- 
sion has been tasked with the resolving 94 action items identified 
in the internal management review of ISCD. And the subcommittee 
has asked you to do a lot of other things, to identify gaps, to 
streamline the inspection process, better train personnel and to 
conduct robust stakeholder outreach. 

Mr. Wulf, you, last week, during a hearing of the Environment 
and Economy Subcommittee of House Energy and Commerce, you 
said “this funding level would hurt DHS’s ability to make good on 
its promise to clean up the CFATS program.” You further indicated 
that NPPD has turned an important corner and “a cut could 
force — would force some very, very difficult choices; it would essen- 
tially cut the legs out from under us.” 

Perhaps I should first ask if you want to elaborate on those com- 
ments. I think they are pretty straightforward and pretty clear. 
And I do want to ask Ms. Spaulding to expand on the comments. 

Given the funding level in the House-passed bill for fiscal 2013, 
it is $29.1 million below your requested level. How could you pos- 
sibly complete all these tasks and continue other critical functions, 
such as the work on ammonium nitrate, in a timely manner? And 
if this cut were ultimately adopted, what difficult choices would 
you need to make? I am sure you have thought about that. Would 
you delay making all the necessary corrections identified in your 
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action plan, for example, to fully address the management issues 
identified in the November 2011 memo, or are there other items 
you are considering? 

Ms. Spaulding. Thank you. Congressman. 

I would echo what Director Wulf said; it would be absolutely dev- 
astating to the program. We would of course focus all of our ener- 
gies on the absolutely essential and core activities, imperatives of 
the program, and that would be conducting those authorization in- 
spections and trying to approve site security plans. But that proc- 
ess would be slowed, and our ability to do a variety of things that 
will make this program — able to implement this program and con- 
tinue the progress that we have made so far, would be seriously 
hampered. For example, one of those things is our interaction with 
industry. We just were talking about how important that is and 
learning from industry in this iterative process, we have learned 
lessons about how to make our tools more effective and easier for 
the industry to use and providing both more useful information for 
us and for industry. That work would grind to a halt, any improve- 
ment — in fact, the ability to simply maintain our current IT sys- 
tems would be threatened by such a devastating cut, and I could 
go on. 

Let me say that I understand that that mark was a reflection of 
the deep level of concern on the committee, on the subcommittee, 
with regard to the implementation of this program. And my hope 
is that, given the substantial progress we have made, is that you 
will understand that we have turned a corner. There is a lot more 
to be done. We have an incredibly dedicated and committed and ca- 
pable workforce determined to continue that progress. And we cer- 
tainly hope that we will justify a renewed sense of faith in our abil- 
ity to get that done. But suffice it to say that if that mark remains 
where it is, it would have a devastating impact on our ability to 
implement these programs. 

funding: continuing resolution’s impact 

Mr. Price. Where does the CR leave you for now for the next 6 
months? 

Ms. Spaulding. The continuing resolution puts us at the fiscal 
year 2012 spending level. And I should say, I want to thank this 
committee for its efforts to ensure that the CFATS extension was 
explicitly included in the continuing resolution. It is vitally impor- 
tant. And I will just take this moment to make a plug for a perma- 
nent authorization of CFATS. I think we have talked about — we 
talked in our July testimony about the ways in which CFATS has 
made America safer already and about the 2,700 facilities that 
have either eliminated or reduced their chemicals of interest or 
have made other modifications to bring them out of that high-risk 
category and made America safer. And I think more companies 
would move in that direction if they saw that CFATS was perma- 
nent, was going to be permanently in place, and I think that is vi- 
tally important. 

But I am very grateful for the work that was done to extend the 
authorization. And one of the challenges we will have with the CR, 
of course, is determining the spend rate during that period of time, 
not knowing what the 2013 number will be. 
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Mr. Price. Thank you. 

Mr. Aderholt. Well, let me just mention and point out that 
when the budget was fully developed last fall, the internal memo 
had not been leaked. The action plan was not completed and GAO 
had not commenced its review. As we sit here this morning in the 
hearing, the action plan is still being worked on. There are many 
items that are not close to answered, including reviewing staffing 
requirements, and so it would be premature to dedicate scarce re- 
sources today when there are still so many actions, so many ques- 
tions that are unanswered. I understand, of course, there will be 
a carryover of $20 million from this year that cannot spend. So I 
just wanted to add that. 

Mr. Carter. 


funding: justification 

Mr. Carter. I thank you, Mr. Chairman. 

So your responsibility as an agency is about 5 years old, right? 

Ms. Spaulding. Our responsibility, CFATS was enacted, I be- 
lieve, in 2006, and we got the regulation in place in 2007. 

Mr. Carter. So it is 5 years. Okay. Well, first off, how does the 
threat of a terrorist attack on one of these facilities rank as a secu- 
rity risk as we look at the overall program of security risks in 
America? 

Ms. Spaulding. Congressman, I am not sure I can place it in the 
pantheon of risks that we face, but it is certainly a risk that we 
take very seriously. 

Mr. Carter. Well, I guess I am wondering, has it increased or 
decreased as a result of the work that you have done? 

Ms. Spaulding. Well, I think the threat has probably not signifi- 
cantly changed as a result of the work that we have done. I think 
the risk has been reduced as a result of the work that the men and 
women in ISCD have undertaken. As I said, I think America is 
safer today. They are at a lower risk from harm from one of these 
chemical facilities than they were before Congress enacted this im- 
portant legislation. 

Mr. Carter. Well, you are complaining about the reduction in 
the proposed funds that have come into this agency. If I under- 
stand the chairman correctly, it will be $20 million from last cycle 
that you are not going to be utilizing. I don’t claim to be an expert 
in this field. I am learning and listening as we sit here, but 2 out 
of 120 is not a real great track record of what we have been dis- 
cussing on these plans. And, you know, we should spend our money 
on things that actually accomplish their mission, and quite hon- 
estly, I think that — and this is my personal opinion, and that is 
why I asked the ranking member — I don’t know, there may be 
other things more important. But to me, they are not more impor- 
tant, because I heard back when I was a brand new lawyer, that 
we could kill most of the population of Texas with one bump be- 
tween two ships. And with that kind of testimony, two or three 
chemical plants on the Houston ship channel, and there are plenty 
of them down there, could wipe out the whole State, and maybe the 
Western part of the United States. I don’t know. That seems pretty 
damn serious to me. And I would say your track record is relatively 
poor. 
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Now, do you want to tell me how you can defend the track record 
and increase this amount of money? I would like to hear it. 

Ms. Spaulding. Okay, thank you. I appreciate the opportunity. 
Let me state first, on the basis of discussions with our budget staff 
in the last few days, it appears at this point as though our carry- 
over will be around $4 million; that in fact we will have over a 
99.5-percent obligation of our 1-year funds and that our carryover 
will be an historical low of about $4 million. 

In terms of, you know, how do we justify spending this money, 
again, I believe that we have turned the corner on this program, 
and that it is absolutely vital. And to suggest that we should per- 
haps pull the plug on a program that has already made America 
safer and that is making substantial progress toward an absolutely 
vital objective that I know you share with us of making chemical 
facilities pose less of a risk of terrorist sabotage, theft or release — 
it is — you know, we have learned a lot, as we have discussed in the 
last 5 years. We have made substantial progress. Our progress, 
again, just since July I hope demonstrates the degree to which we 
are now on a positive track. 

With regard to the action plan, we have completed now 70 of 95 
items, and there are 95 items because we have been adding items. 
This is a living dynamic document. And when GAO made its rec- 
ommendation, we embraced that recommendation and added it as 
the 95th action plan item. But we have been moving forward on 
those. That is 17 more items since the July hearing. 

So I do think that your concern is justified with respect to how 
long it has taken us to get here, but I do believe this program has 
turned a corner, and it is absolutely vital to the safety and security 
of Americans, and to pull the plug now would be a huge mistake. 

PUBLIC-PRIVATE PARTNERSHIPS: INTERACTION WITH INDUSTRY 

Mr. Carter. I believe you testified — and if I misunderstood you, 
you can correct it now — that during the regulatory process where 
you were writing regulations, there wasn’t a lot of interaction with 
industry, but now you are much more involved in interacting with 
industry. Is that what your testimony was? 

Ms. Spaulding. I am not sure during the writing of the regula- 
tion. I think that was the early stages and my understanding — I 
wasn’t on board then — is that there was good — what industry tells 
me is its sense is there was good interaction early on. Then there 
was a period of time when it was much more spotty. But I think 
there is a consensus that over the last year, certainly there has 
been a great deal more. 

Mr. Carter. As you re-analyze your duties and your agencies 
and your 95 items that you have got to deal with and you have, 
at least within this last year, started to include industry, could you 
tell us what the mindset of the people who work in this industry, 
in your department, was that they didn’t talk to industry? Because 
one of the concerns that we have in this country today is regula- 
tions are being passed without really paying any attention to what 
those regulations do to people, and I would like to know what that 
gap, what caused that gap. 

Ms. Spaulding. All right. And it is hard for me to say. I do 
think — I am not suggesting there was no interaction with industry. 
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I think there has heen ongoing, and there has always been that 
interaction through the Chem Security Coordinating Council, for 
example. 

But I suspect part of it was the process — I think some of the — 
a lot of the concern arose in the personnel surety context, where, 
frankly, the process simply hamstrings our ability to continue to 
have conversations. We had — I think we certainly received a lot of 
comments from industry, but our ability to sit down across the 
table and kind of work through issues, once you have initiated that 
process at 0MB, is extremely limited. And so my suspicion is that 
that was a period of time in which there was some frustration on 
both sides. 

TRANSPORTATION WORKER IDENTIFICATION CREDENTIAL: CLARIFYING 

PROGRAM MISSION 

Mr. Carter. Well, a 5-year period of time is a long time. 

And I realize I may be running over time, Mr. Chairman. One 
more question. 

You were discussing earlier about the TWIC program. I under- 
stand that that exists on several facilities, especially in port areas, 
and that now you are analyzing that to see if that — ^you were pro- 
posing a duplicative process originally. If I understand your testi- 
mony, you are now saying you are taking a look at being able to 
utilize the information that you gained from TWIC to possibly 
make these CFATS sites more secure. 

One of the things that at least I have been told by some is that 
you are insisting on setting up a new program so that you are able 
to track people. And I guess my question is, isn’t that a law en- 
forcement, or do you have a law enforcement portion of your duties, 
or isn’t that a law enforcement duty, to track people? Because there 
are those who think that is the reason TWIC has not been utilized. 

Ms. Spaulding. Right. And there have been a number of mis- 
understandings about this program, and that is one of them. I very 
much appreciate the opportunity to correct the record on that. 

This is absolutely not — there is not an objective, a goal to track 
people, but the way that we are now looking at implementing this 
really would not allow us to track people. So it really has nothing 
to do with the location of individuals. 

Again, for example, the ability for a company to file company- 
wide rather than facility by facility, there is no way for us to know 
what facility an employee is at on any given day. Even as we look 
at electronic verification of the TWIC cards, one of the things we 
are trying to explore is could it be, particularly for smaller facili- 
ties, at a central location, and a number of them could use the 
same reader, for example? That would not allow us to know who 
is going into which facility. 

All of these things present, you know, a trade-off, frankly, from 
a security perspective, and one of the things we have had to think 
very carefully about is, we have to be true to our national security 
imperative. So it has required us to talk with other regulatory 
agencies and other elements of government, frankly, to see ways in 
which we can mitigate the national security risk that comes from 
trying to ease the burden on industry, and that is the balance we 
are trying to find and I think we going to be able to do that. 
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Mr. Carter. Thank you. 

Thank you, Mr. Chairman. 

Mr. Aderholt. Mr. Price, do you have anything else? 

Mr. Price. No, thank you, Mr. Chairman. No further questions. 

DELISTING FACILITIES 

Mr. Aderholt. Let me just close with one question I wanted to 
ask about the delisting of facilities. In your opinion, how many 
companies have been removed from the chemical of interest listing 
from their sites? I think the concern here is the validation with re- 
moval. I just was wondering how many companies that you would 
estimate have been removed as chemicals of interest? 

Ms. Spaulding. Sir, I would start with around 2,700 facilities 
that were preliminarily tiered as potentially high risk, that, as I 
said, eliminated, reduced — or reduced their chemicals of interest or 
otherwise made modifications to bring them below the threshold for 
regulation. 

David, are there additional numbers there? 

Mr. WULF. That is it right now, 2,700. 

Mr. Aderholt. What is the policy for redetermination that you 
go through? 

Ms. Spaulding. So companies can, under the regulation, request 
a redetermination. They are required to notify us if they make a 
material modification to their holdings, and they can request that 
we review their tier level and make changes. 

And I would point out that that is one of the ways in which 
tiering can change. So we have a process where we assign prelimi- 
nary tiers and then what we call final tiering. But one of the things 
that we have learned — we need to emphasize when we talk with 
industry is that tiering is a dynamic process, and there are a num- 
ber of reasons in which people’s tiers can change, things that the 
industry does, but also things that we learn about how to do our 
tiering methodology better. 

Mr. Aderholt. How do you verify that these chemicals have 
been removed? 

Ms. Spaulding. Do you want to talk to that? 

Mr. WULF. In some cases, we will verify through phone calls or 
visits to a facility by the chemical security inspectors, but it will 
vary on a case-to-case basis. 

Mr. Aderholt. We understand from the GAO, we have heard 
some companies have been moving the chemicals of interest to 
other sites or just placing them on rail cars or in containers offsite 
to avoid regulation. Has this occurred, and what assurances could 
you give us here at the subcommittee that it has not occurred? 

Mr. WuLF. I think on a case-to-case basis, it is probably difficult 
for us to say or to assure you that it hasn’t occurred in any case, 
but we strongly, strongly believe, and are talking extensively with 
our industry stakeholders and regulated and unregulated facilities, 
that these 2,700 facilities have in the aggregate reduced their risk 
by lowering or eliminating chemicals of interest at their facilities. 
So that is our overall sense of it. 

Mr. Aderholt. But there could be the possibility they just move 
it offsite, is that correct? 
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Mr. WULF. They could go to different processes that may result 
in chemicals being off site or in transit, in the transportation proc- 
ess, and perhaps being delivered to the facility just in time for use 
and not stored there for a long period of time. And that sort of sce- 
nario, I don’t know that that increases the amount of time that the 
chemicals are on the roads or on the rails, but it is a process that 
does reduce the risk at that facility. 

Mr. Aderholt. But that would certainly be something you would 
be concerned about, if they just put it on a rail car just for the pur- 
pose of it being offsite. 

Mr. WuLF. The notion of just transferring the risk, moving the 
risk around, is something that would concern us, absolutely. 

Mr. Aderholt. What would you do if you found out that this was 
occurring? 

Mr. WuLF. I think that is something we would have to address 
with our interagency partners, because our jurisdiction is to regu- 
late security at high-risk chemical facilities. There are many other 
agencies that come into the mix on the rails, on the roads, et 
cetera. 

Mr. Aderholt. But certainly if you found the company was doing 
this, trying to hide the fact that they had these chemicals, you cer- 
tainly would take quick and swift actions on that? 

Mr. WuLF. We would absolutely have discussions with our part- 
ners. 


funding: carryover 

Mr. Aderholt. Okay. Well, I just want to touch base on a couple 
of things I think we want to clarify. I mentioned earlier the $20 
million from this year that could be spent. I think we need to clar- 
ify some terms. You said there is around $4 million. But let me 
clarify this to make sure I understand that there is about $20 mil- 
lion of funds that have been classified as 2-year funds that could 
be used in fiscal year 2013, is that correct? 

Ms. Spaulding. Mr. Chairman, I am going to have to get back 
to you with the exact numbers. They have been changing on an al- 
most daily basis, as you might expect, as we approach the end of 
the fiscal year and are closing contracts, et cetera. My under- 
standing is that we had anticipated a significantly greater carry- 
over than we have wound up with at the end of the year, that we 
have in fact been successful in obligating those funds and moving, 
and I think, again, it is a reflection of the substantial progress that 
we have made in implementing this program and moving things 
forward. 

Mr. Aderholt. But there possibly could be — I understand there 
is $20 million that is in that, so you can 

Ms. Spaulding. Sir, my staff tells me that there is $20 million 
of 2-year money, but that $16 million of that is on contract for fis- 
cal year 2012, leaving $4 million. 

Mr. Aderholt. Okay. All right, well thank you for your testi- 
mony here, and all of you being here today. 

Let’s remember that it has been 5 years and hundreds of millions 
of dollars since the program was created. Today there has been a 
lot of statements about what you plan to accomplish this year. Cer- 
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tainly, I think this subcommittee will hold you to that and monitor 
this closely as we move forward in your progress. 

So, again, we appreciate your being here, and especially after our 
last hearing, when you were only here for a few minutes. We got 
through the entire hearing today without a series of votes, so that 
is good news for the hearing. So, again, we thank you for being 
here, and the hearing is adjourned. 
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Suzanne Spaulding, Deputy Under Secretary, National Protection and Programs 
Directorate, DHS 

David Wulf, Director, Office of Infrastructure Protection, DHS 

Department of Homeland Security - Chemicai Facility Anti-Terrorism Standards (CFATS) 

Program 

September 20, 2012 


Site Security Plans 

Question; Why has there been such a delay in authorizing plans and when will NPPD actually 
approve a site security plan? 

ANSWER: As Deputy Under Secretary Spaulding testified, the Department of Homeland 
Security (DHS) already has started approving site security plans (SSP). DHS approved the first 
SSP on September 4, 2012. As of November 27, 2012, nine SSPs have been approved and more 
than 150 SSPs have been authorized. Earlier this year, the Infrastructure Security Compliance 
Division (ISCD) re-worked and improved its SSP review and inspection processes. This has 
enabled ISCD to review, authorize, and approve SSPs more efficiently and effectively. Industry 
stakeholders can expect that the pace of authorizations and approvals will continue to increase in 
the future. 

Question: When do you estimate all 114 tier one site security plans will be authorized, 
approved and inspected? What about the rest of the tiers? Please provide by tier and by quarter. 

ANSWER: Prior to approving an SSP, or an Alternative Security Program (ASP) in lieu of an 
SSP, the ISCD must first review and then authorize the SSP or ASP. The review process is 
initiated when ISCD receives the SSP or ASP from a covered facility. ISCD then reviews the 
SSP/ASP to determine preliminarily if it satisfies the applicable Risk-Based Performance 
Standards (RBPS) under the Chemical Facility Anti-Terrorism Standards (CFATS) regulation, 6 
C.F.R. Part 27. This process typically involves discussions between ISCD staff and the facility 
and often requires additional information from the facility and revision of the SSP/ASP before 
ISCD can complete its initial review and issue the facility a Letter of Authorization for its 
SSP/ASP. After issuing a Letter of Authorization, ISCD conducts a comprehensive and detailed 
authorization inspection. The inspection results, as well as any further revisions that the facility 
may make to the SSP/ASP, are reviewed to make a final determination as to whether the 
facility’s SSP/ASP satisfies the applicable RBPSs and whether to issue a Letter of Approval. 
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Upon approval, the facility must implement the applicable provisions of the SSP/ASP. If ISCD 
determines that an SSP/ASP does not satisfy the applicable KBPS, ISCD may issue a Notice of 
Deficiency and require the facility to resubmit a sufficient SSP/ASP. If the facility fails to do so, 
ISCD may disapprove the SSP/ASP. 

ISCD is scheduled to complete authorization inspections by the fourth quarter of Fiscal Year 
(FY) 2013 for Tier 1 facilities and by the second quarter of FY 2014 for Tier 2 facilities. 
Following the authorization inspection, facilities are generally granted an additional 45 days to 
make necessary modifications to their SSP/ASPs. ISCD will then review the re-submitted 
SSP/ASP and make a final determination on whether the SSP/ASP warrants the issuance of a 
Letter of Approval, In some cases, the facility may require a technical consultation and another 
opportunity to revise its SSP/ASP. Therefore, the schedule to issue Letters of Approval to 
facilities is projected to be the first quarter of 2014 for Tier 1, and by third quarter 2014 for Tier 
2 facilities. 

The population of Tier 3 and Tier 4 facilities, which pose relatively lower risks than Tier 1 and 
Tier 2 facilities, is much larger and DHS is developing options to evaluate their SSPs/ASPs 
effectively. 


Action Plan 


Question: What is the status of the action plan and what is the schedule for completing all 
items? 

ANSWER: As of November 8, 2012, ISCD has completed 78 of 95 action items. Some of the 
action items are longer term items, such as Action Item 47, which calls for the revision of the 
Chemical Security Assessment Tool (CSAT), and require more time to complete. The revision 
of the CSAT tool is the final milestone on the Action Plan and we project it to be completed in 
the third quarter of FY 2014. 


Public / Private Partnerships 

Question: Has DHS stopped promoting and building partnerships between DHS and the 
facilities it regulates? 

ANSWER; No, DHS has continued extensive outreach aimed at building these important 
coimections with its stakeholders. As Deputy Under Secretary Spaulding testified, since her 
arrival last fall, she has personally participated in numerous meetings with industry. For 
example, she has several times attended the Chemical Coordinating Council meetings. Also, the 
Under Secretary, the Deputy Under Secretary, the Assistant Secretary for Infrastructure 
Protection, and ISCD Director Wulf, along with several members of the ISCD staff, attended and 
spoke at the 2012 Chemical Security Summit, which is jointly hosted by industry and the 
Department. 


Page 2 of 21 



108 


The Department’s engagement in relationship-building has occurred in various forums and has 
been ongoing since the program’s inception. Senior NPPD, ISCD, and Infrastructure Protection 
(IP) leadership and CFATS staff members have participated in thousands of outreach and 
stakeholder engagements. The table below, which contains a high-level snapshot of the outreach 
activities conducted to date by ISCD field personnel, clearly demonstrates the Department’s 
continued desire to engage the regulated community and other stakeholders in the development 
and implementation of the CFATS program. 


Field Actix hies 
As of October 22, 30! 3 


]■ immI \ 

< AVS 

PAIs* 

P^e.scnlatiflll^ 

1 Kill 

( )«iiU .is 1 

2007 

0 

0 

53 

0 


2008 

99 

0 

244 

95 


2009 

63 

0 

147 

136 


2010 

107 

119 

102 

385 


2011 

534 

61 

131 

1,124 

2,644 

2012 

288 

N/A* 

117 

2,697 

1,721 

2013 

14 

N/A* 

20 

** 

** 

Total 

1.105 

180 

814 

4.437 

4,365 


*Discontinued; process incorporated into CAV process. 

*’* Data is current as of September 30, 2012. Data for FYs 2007-2010 are not available. 

Compliance Assistance Visits (CAVs): CAVs are visits at regulated or potentially regulated 
chemical facilities with the goal of providing compliance and technical assistance in the 
completion of the CSAT registration, Top Screen, Security Vulnerability Assessment, or SSP 
processes. 

‘Preliminary Authorization Inspections (PAI): From FY 2010 through FY 2011, ISCD 
conducted PAIs that, although more narrowly tailored than CAVs, were similar to them in many 
ways. PAIs were visits to regulated chemical facilities with the specific goal of educating them 
on the level of detail that is required within the SSP in order for DHS to adequately review and 
assess the facility’s security posture for compliance with CFATS. These types of activities are 
now captured within the “CAV” category. 

Presentations: Federal, state, local, or private industry events where an Inspector provides a 
presentation or participates on a panel to provide information regarding the CFATS program. 

Field Meetings: Meetings with Federal, state, local, or private industry stakeholders in which 
Inspectors participate to better familiarize themselves with other programs/activities and 
harmonize with key stakeholders. 

Stakeholder Outreach: Meetings at CFATS-regulated or potentially regulated facilities at 
which Chemical Security Inspectors introduce themselves, meet key facility representatives, 
provide basic outreach materials, and familiarize themselves with the local regulated 
community. 
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In the past three months alone, ISCD has conducted hundreds of outreach activities. While the 
majority of the outreach engagements are indicative of the routine outreach conducted daily in 
support of CFATS, the Department also performs tailored outreach efforts as appropriate in 
relation to specific programs such as Personnel Surety, potential improvements to the CSAT 
suite, and development by industry of ASP templates. Some specific industry engagement in 
each of these three activities is described below. 

Personnel Surety 


Since July, following the Department’s withdrawal of the CFATS Personnel Surety Program 
Information Collection Request from 0MB, DHS has sought industry and other stakeholder 
feedback in regard to the Department’s development of a proposed approach to the CFATS 
Personnel Surety Program. In support of that effort, the Department has met with various 
leadership and/or members of the Chemical and Oil and Natural Gas Sector Coordinating 
Councils on CFATS Personnel Surety at least once a month since July 2012. Additionally, the 
Department has held numerous meetings with other key stakeholders. In September and October 
of 20 1 2, the Department held conference calls and/or meetings with many of those key 
stakeholders, including: 

• Agricultural Retailers Association 

• American Chemistry Council 

• American Coatings Association 

• American Fuel & Petrochemical Manufacturers Association 

• American Petroleum Institute 

• Agricultural Retailers Association 

• American Trucking Associations 

• Blue/Green Coalition 

t Chemical Producers and Distributors Association 

• Institute of Makers of Explosives 

• International Institute of Ammonia Refrigeration 

• International Liquid Terminals Association 

• National Association of Chemical Distributors 

• Society of Chemical Manufacmrers and Affiliates 

• The Chlorine Institute 

• The Fertilizer Institute 

Chemical Security Assessment Tool 


The Department has begun a similar outreach effort with regard to the technical improvement of 
its information technology tools and the various applications that compose the CSAT. Over the 
past few years, through various interactions with industry, DHS has received significant 
feedback on and suggestions for ways to improve CSAT and its three primary applications — the 
Top-Screen, the Security Vulnerability Assessment (SVA), and the SSP. The Department 
believes that such technical improvements will make the overall CFATS process more user- 


Page 4 of 21 



110 


friendly for industry, while simultaneously making the CFATS SSP review and inspection 
process more efficient and effective. 

In order to ensure we are incorporating industry feedback as appropriate and practicable in the 
technical refinement of the CSAT applications, the Department has begim meeting with 
members of the regulated community and intends to hold additional meetings with industry 
stakeholders over the next few months. This likely will include roundtables in locations 
throughout the country to solicit additional feedback on the CSAT. hr addition to continuing to 
engage industry and other stakeholders on suggested technical improvements and new features, 
the Department intends to pilot or “beta test” planned CSAT refinements with members of 
industry at the appropriate time during the development of the modified CSAT system. 

Alternative Security Programs 

Many members of the regulated community and their representative industry associations have 
expressed interest in exploring ways to use the ASP provisions of the CFATS regulation as a 
more streamlined alternative to the SSP submission and review process. The Department shares 
this goal and ISCD has been holding discussions with industry stakeholders with regard to their 
development of ASP templates on behalf of their members. One example has been ISCD’s 
engagement with the American Chemistry Council in support of its efforts to develop an ASP 
template for use by interested members of its organization. The American Chemistry Council 
developed a template that was piloted at facilities in August and October. The American 
Chemistry Council has indicated that it expects the ASP template will be available for wider use 
by its members later this year. In addition, DHS has been in discussions with other industry 
stakeholders and associations about developing templates for their members and sub-sectors. 

Question: Did the DHS or NPPD’s Office of General Counsel ever discourage the development 
of partnerships between DHS and regulated facilities and if so, why? Has DHS’s Office of 
General Counsel ever developed a written opinion on forming partnerships and the relationships 
between CFATS and the regulated community? If so, please provide the Subcommittee a copy 
of any written materials. 

ANSWER: Neither DHS nor any component of DHS would ever discourage the development 
of strong and productive relationships between DHS and facilities regulated under CFATS. As 
explained in the previous response, the Department has actively promoted the development of 
such relationships. 


Delisting Facilities 

Question; One of the successes that are often mentioned is that many companies have removed 
the chemicals of interest but I am concerned with how we validate the removal. How many 
companies have removed “chemicals of interest” from their sites? 

ANSWER: As Deputy Under Secretary Spaulding has testified, since the inception of CFATS, 
more than 2,700 chemical facilities have eliminated, reduced, or otherwise made modifications 
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to their holdings of potentially dangerous chemicals and are now no longer considered high-risk 
under CFATS. 

Question: I understand that DHS has slowed, or even stopped the redetermination of facilities 
that have either reduced or eliminated their chemicals of interest holdings. In fact, 1 understand 
that there have been cases where redeterminations have been held up for years. What is the 
policy for redeterminations and how many facilities are awaiting a new determination? What 
processes does DHS have in place to verify that such chemicals have been removed? 

ANSWER: In accordance with CFATS, if a covered facility that was previously determined to 
present a high level of security risk has materially altered its operations, it may submit a Request 
for Redetermination and may also request a meeting regarding the Request. If ISCD is unable to 
confirm that a facility has sufficiently altered its operations (e.g., its processes or chemical 
inventory) to justify a redetermination based upon the submitted documentation, then a CAV is 
scheduled with the facility to verify the information. 

In most instances, the Request for Redetermination is based upon a material modification and so 
the facility also must complete and submit a revised Top-Screen to the Department within 60 
days of the material modification. DHS will review the revised Top-Screen, along with any 
other available information, and then notify the facility as to whether or not there are any 
changes in the facility’s status as high-risk or to its risk-based tier. 

This year, DHS has completed review of more than 1 ,050 revised Top-Screens that have resulted 
in either the non-regulation or re-tiering of many facilities. Currently, ISCD is working with 400 
facilities that have submitted revised Top-Screens due to material alterations of their operations. 

Question: We understand that GAO has heard that some companies may be either moving 
chemicals of interest to other sites or placing them on rail cars or in containers offsite so as to 
avoid regulation. Has this occurred, and what assurance can you provide this Subcommittee that 
this has not occurred? What action would DHS take if it found that it was occurring? 

ANSWER: Some facilities determined by the Department to be high-risk, as well as some 
facilities that have not yet been determined to be high-risk, have taken various approaches to 
handling their chemicals of interest (COI) including, in some cases, consolidating holdings of 
COI at a single facility, relocating the holding containers offsite, or switching to “just in time” 
delivery systems. If DHS becomes aware (e.g., through a revised Top-Screen) of a modification 
that has the effect of shifting the risk to a facility not regulated under CFATS but potentially 
subject to another regulatory entity (e.g., placing a rail car offsite; relocating the chemical to a 
portion of the facility regulated under the Maritime Transportation Security Act), the Department 
would contact the appropriate entity (e.g., the Transportation Security Administration; the U.S. 
Coast Guard) or take other appropriate steps as necessary. 

Managing the Regulatory Proces.s and Site Security Plan Reviews 

Question: Secretary Spaulding, the Subcommittee has heard that some of the security plans are 
as long as 1500 pages and can take weeks to review. Why does this occur, what barriers does the 
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CFATS program face doing reviews of these plans, and what is NPPD and the CFATS program 
doing to overcome these barriers? 

ANSWER: The typical length of a CFATS SSP is a few hundred pages, although some do 
exceed 1,000 pages. While the length of an individual SSP contributes to the overall amount of 
time it takes for the SSP to be reviewed, the most important factor that has led to a lengthy 
review process is that the majority of initial SSP submissions do not contain sufficient 
information for the Department to properly evaluate the actual level of security at the facility. 

As a result, the Department is required to engage facilities and work with them to revise and 
resubmit their SSPs with more substantial data. Through extensive outreach efforts, which have 
included CAVs to virtually all Tier 1 facilities, the quality of SSP submissions has greatly 
improved, which has facilitated the review, authorization, and approval of SSPs. 

In addition, over the course of the last year, the Department conducted a review of its SSP 
review process and, based on that review, has developed a streamlined SSP review process and 
improved the integration of field inspectors into that process in order to improve the speed of 
reviews. Additionally, the Department has — in coordination with industry stakeholders — begun 
a process to modify its SSP tool to make it more efficient for both the submission and the review 
processes. The Department also is working with industry to determine if ASPs could be used to 
develop more concise plans for review and a more streamlined review process. 

Question: The Subcommittee is concerned that it could take several years before it completes 
inspections at all chemical facilities covered by the Rule. 

a) Why will these inspections take so long to complete? 

b) What is DHS doing to develop procedures for doing inspections and is it taking 
steps to determine where it can streamline the inspection process? 

e) What challenges does DHS face in developing an effective inspection process and 
what is DHS doing to overcome these challenges? 

ANSWER: Under CFATS, an authorization inspection cannot be conducted until ISCD issues a 
Letter of Authorization for an SSP or ASP. ISCD has worked to improve and expedite the SSP 
review process. This expedited process will help to shorten the timeline to complete 
authorization inspections at all chemical facilities. 

ISCD also has made substantial improvements to the inspections process, which enabled ISCD to 
resume Authorization Inspections at Tier 1 facilities on July 16, 2012, ISCD anticipates the rate 
of authorizations, inspections, and approvals will continue to increase. 


Tiering Challenges 


Question: I understand that you are reviewing the “tiering” process due to concerns that 
facilities may have been inappropriately “tiered” and that there have been delays in “tiering” 
certain sectors. Has DHS encountered any additional issues with regard to placing facilities in 
tiers and are some facilities, such as those that refine oil and natural gas, still awaiting a DHS 
decision as to how they will be tiered? 
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ANSWER: ISCD is reviewing the tiering process as part of its commitment to conduct a 
thorough review of the CFATS risk assessment approach, which is reflected in Action Item 94 of 
ISCD’s current Action Plan. To fulfill this commitment, ISCD developed a three-phased 
approach: 

1 . Thoroughly document all processes and procedures relating to the tiering 
methodology 

2. Conduct an internal DHS review of the complete tiering process 

3. Conduct an external peer review of the risk-based tiering methodology 

As we have briefed the committee, based upon the steps already taken, the Department identified 
some technical issues potentially impacting a small number of facilities. 

With regard to aboveground gasoline storage facilities (i.e., gasoline terminals), a number of 
these facilities have been preliminarily tiered but DHS has suspended issuance of final tiering 
determinations for such facilities while DHS considers public comments on certain technical 
issues related to assessing potential risks from such facilities. 

Question: I understand that the tiering models haven’t been peer reviewed since an informal 
peer review of the initial development. Does NPPD intend to have the model peer reviewed 
prior to another retiering exercise? 

ANSWER: An external peer review of the tiering methodology has been initiated and is due to 
be completed in the third quarter of FY 2013. 

Early Unionization of the Inspector Workforce 

Question; Did NPPD limit the bargaining rights of its union - how can we be assured that the 
safely of our nation will not be compromised by union negotiations? 

ANSWER: NPPD has not limited the barging rights of its union. There is no concern about the 
safety of our Nation being compromised by labor union negotiations. The union shares with 
NPPD an interest in moving the program forward and has provided valuable perspectives in the 
implementation of the program. American Federation of Government Employees (AFOE) Local 
918 and NPPD enjoy a productive relationship that has grown through close coordination, 
communication, and regular meetings. 

Question: What is the impact of presence of union at this stage of the program? 

ANSWER: The union shares with NPPD an interest in moving the program forward and has 
provided valuable perspectives in the implementation of the program. AFGE Local 9 1 8 
and NPPD enjoy a productive relationship that has grown through close coordination, 
communication, and regular meetings. The union has expedited its review of key policies and 
procedures that have enabled the ISCD to turn the comer in implementing the CFATS program. 
We will continue to build upon this working relationship to ensure that AFGE Local 918 
continues to be a stakeholder in helping to move the CFATS program forward. 
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Question: What challenges does DHS face implementing the program with a union? 

ANSWER: The AFGE Local 918 has been supportive of the CFATS program and shares 
ISCD’s vision for the program’s success. The union has expedited its review of plans for 
implementing key policies and procedures that have helped ISCD turn the comer in 
implementing the CFATS program. 

Personnel Surety tPENTt 


Question: What is the plan for a rewrite - do you have a schedule for when you will be reaching 
out to industry and when we will see a new proposal? 

ANSWER: NPPD is seeking to re-initiate the Paperwork Reduction Act process as soon as 
possible by publishing a notice in the Federal Register seeking comments for 60 days. 

As Director Wulf and Deputy Under Secretary Spaulding testified, NPPD started to reach out to 
our industry stakeholders about persormel surety prior to the September hearing. Since the 
hearing, we have continued to meet with leaders and members of the Chemical Sector 
Coordinating Council and the Oil & Natural Gas Sector Coordinating Council, on a variety of 
topics. In addition, NPPD issued invitations to a broad range of stakeholders and subsequently 
held conference calls with stakeholders and their members to discuss the CFATS Personnel 
Surety Program and solicit suggestions on ways to improve it. 

Question: How do you plan to incorporate TWIC into the credentialing framework? 

ANSWER: As Deputy Under Secretary Spaulding and Director Wulf testified, we recognize the 
need to find appropriate ways to leverage the Transportation Worker Identification Credential 
(TWIC). The Department supports the sharing and reuse of vetting results among different 
screening programs and is actively considering, and discussing with stakeholders, options for 
effectively leveraging existing vetting, including through use of technologies for electronic 
verification of existing credentials. 

Question: How much taxpayer money wiU withdrawing and re-drafting the ICR cost? 

ANSWER: NPPD has not estimated the cost to taxpayers associated with withdrawing and re- 
drafting the information collection request (ICR). However, the primary cost categories would 
likely be the time of Federal employees to meet with key stakeholders and to redraft the ICR and 
Paperwork Reduction Act notices. 


Use of Contractors 

Question: An enduring issue at other DHS offices and components is the extensive use of 
contractors to do work that looks a lot like the work of government employees. To what extent 
is this problem within the CFATS program? Please discuss the concerns associated with the 
reliance on contractors and what CFATS, IP, and NPPD doing to resolve this issue. 
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ANSWER: To ensure that ISCD has the appropriate mix of Federal and contractor skills, 
expertise, experience, and other assets necessary to effectively achieve the Department’s 
mission, each new and re-competed contract is analyzed utilizing the DHS Balanced Workforce 
Strategy tool to assess risk, ability to provide adequate oversight, and cost. 

Question: Contractors are widely used by NPPD, particularly in the Office of Infrastructure 
Protection, which relies heavily on the national labs for support. In fact, some of the problems 
associated with placing facilities in tiers encountered last year could be attributable to the 
problems at the labs. What actions are NPPD and IP taking to promote better oversight of the 
labs and the contractors that provide support to IP and its components? 

ANSWER: NPPD has increased its oversight of its support procurements. In addition to 
contracting officer staff and the contracting officer representative oversight, NPPD has increased 
its procurement oversight team by one full-time equivalent, from 1.5 to 2.5 full-time equivalents 
to ensure timely audits to verify that interagency agreements (lAA) and contracts are being 
properly administered and, if not, to take corrective action. Additionally, NPPD requests an 
annual procurement plan and works with subcomponents on a weekly basis to ensure that the 
procurement plan is executed appropriately. NPPD ensures that lAAs and contracts have 
qualified personnel to perform quality assurance and surveillance activities and also performs 
balanced workforce assessments to determine appropriate oversight levels and government in- 
house capability. 


“High-Risk" Criteria Used When Tiering Facilities 

Question: Currently, DHS only considers human life and health when tiering facilities - they do 
not consider national security or critical economic assets. Secretary Spaulding, why does DHS 
not consider national security and economic consequences, especially since these factors are 
taken into account by other DHS programs, including the list of tiered critical assets imder 
DHS’s National Critical Infrastructure Prioritization Program? 

ANSWER: National security concerns are the foundation for CFATS, as it is designed to 
improve security at high-risk chemical facilities to prevent terrorists from using dangerous 
chemicals to cause harm to Americans, The Department began by focusing on consequences to 
human life and health when identifying high-risk chemical facilities, in light of the challenges 
associated with accurately identifying with a reasonable degree of confidence economic and/or 
mission-critical facilities in a group as diverse as the chemical facilities potentially subject to 
CFATS. As the CFATS program continues to mature, the Department is considering whether 
chemical facilities should be considered high-risk due to their mission or economic criticality, 
and currently is working with Sandia National Laboratories on a methodology for identifying 
such facilities. 

Question: To what extent has DHS analjfzed the effect of not considering national security and 
economic consequences on the security of the nation, and the number of facilities covered by 
CFATS? 
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ANSWER; The Department is currently in the process of analyzing how it might incorporate 
economic, as well as mission criticality, into the CFATS program and the potential impact of 
doing so in relation to the number of high-risk facilities covered by CFATS. 

Question: To what extent does DHS anticipate the number of facilities covered by CFATS to 
increase if these factors were taken into consideration? 

ANSWER: At this time, the Department cannot speculate on the impact on the number of 
CFATS-regulated facilities based on the addition of economic and mission criticality modeling 
to the CFATS risk-tiering methodology. 


QUESTIONS FOR THE RECORD SUBMITTED BY 

THE HONORABLE David Price 

Steve Caldwell, Director, Homeland Security & Justice Issues, Government Accountability 

Office (GAO) 

Suzanne Spaulding, Deputy Under Secretary, National Protection and Programs 
Directorate, DHS 

David Wulf, Director, Office of Infrastructure Protection, DHS 

Department of Homeland Security - Chemical Facility Anti-Terrorism Standards (CFATS) 

Program 

September 20, 2012 


Internal Mismanagement Issues 

Question: No one was happy to see the depth and breadth of problems revealed in the internal 
management memorandum on NPPD’s ISCD written last November. While NPPD 
management developed an action plan to address these issues and GAO has been reviewing 
progress being made by NPPD on the 94 items in the action plan, only about sixty percent of 
these items have been resolved (59 items out of 94 total in the action plan). Furthermore, GAO 
reports that many of the dates for completing items in the action plan have slipped, some by as 
many as 90 days. GAO also noted that some dates have slipped because the work required to 
complete items was not fully understood when the action plan was first developed. However, 
other dates slipped because the action might have been completed in ISCD, but had not been 
approved by either NPPD or Infrastructure Protection (IP), The lack of closure for some of these 
items suggests that NPPD and IP do not place a high priority on closing them. 

i. Ms. Spaulding, to what extent have you assessed why slippage occurred? 

ii. What challenges prevent NPPD and IP from resolving issues that are clearly 
their responsibility? 
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iii. What are NPPD and IP doing to work with ISCD to bring timely closure to 
action items that are still open and addressing the problems identified in the 
internal memorandum? 

ANSWER: As of November 8, 2012, ISCD has completed 78 of 95 action items. Some action 
items, such as Action Item 47, for example, which calls for the revision of CSAT, are long-term 
activities and require more time to complete. The revision of CSAT is the final milestone on the 
Action Plan, and we project it to be completed in the third quarter of FY 2014. 

Question: Mr. Caldwell, what is GAO’s assessment of how adequately NPPD is addressing the 
items of concern from this internal memorandum? 

ANSWER: (Question is directed to Mr. Caldwell of the Government Accountability Office.) 

Question: Mr. Caldwell, since not all of the action items are specifically segregated to the 
Infrastructure Security Compliance Division or even NPPD, who else needs to be involved to 
implement and close these action items? DHS Acquisition? DHS Office of the Chief Human 
Capital Officer? Are these other DHS entities working well with NPPD and taking the necessary 
steps to ensure we don’t see misuse of funds or hiring practices in the future? 

ANSWER: (Question is directed to Mr. Caldwell of the Government Accountability Office.) 

Staffin2 Concerns in ISCD related to Internal Memo and Corrective Action Plan 

Question: Many of the problems at ISCD may have arisen because of changes in leadership. 
Most recently, the Director, who was one of the primary authors of the internal memorandum 
and in charge of the follow up action items left the agency. NPPD has appointed the other author 
of the memorandum (the Deputy Director for ISCD) to fill the Director position. Ms. Spaulding, 
what assurances can you offer us that this “churning” of senior staff will not continue and how 
are you going to insulate ISCD staff from this “churning” so that they can focus on their day-to- 
day tasks? 

ANSWER: Director Wulf s accession ensured an important measure of continuity within ISCD. 
Ongoing efforts to implement a realignment of the Division and to fill key leadership positions 
on a permanent basis are other important steps in continuing to stabilize the organization and in 
ensuring its long-term success. NPPD Human Capital is in the process of assisting ISCD with 
implementation. To clarify, the former Director remains an NPPD employee. 

Question: Ms. Spaulding, the internal memorandum discusses how ISCD needed to eliminate 
fear in the workplace and improve transparency. Yet I have heard rumors that NPPD is trying to 
identify who leaked this memorandum to the press. How do you reconcile taking possible 
punitive action against an individual found to have leaked the memorandum with your desire to 
enhance morale and become more open with employees so that they can effectively do their job? 

ANSWER: NPPD is not considering punitive action. 
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Question: The Subcommittee understands that the internal memorandum prepared by senior 
ISCD officials was not distributed to the ISCD leaders who were responsible for implementing 
the corrective steps described in the action plan. This is somewhat disturbing given that members 
and their staff and apparently various industry representatives have all seen the memorandum. 
Ms. Spaulding, how do you expect ISCD managers to implement corrective actions when they 
don’t understand the underlying problems as described in the internal memorandum? 

ANSWER: ISCD managers have worked together to identify challenges and implement 
solutions. Additionally, they had the opportunity to review and discuss a draft of the internal 
memorandum before it was forwarded to NPPD leadership for its consideration. The ISCD 
Action Plan, which was included as an appendix to the internal memorandum, has been refined 
and updated and is widely available to the staff as they are engaged in moving the CFATS 
program forward. 

Question: By not providing managers and employees access to the internal memorandum, isn’t 
ISCD setting itself up for criticism that, particularly with regard to being transparent with 
employees while trying to involve them in refashioning ISCD’s culture to make it more 
inclusive? 

ANSWER: As Deputy Under Secretary Spaulding has previously testified, we are disappointed 
that the memo was leaked and subsequently more widely distributed outside of DHS. This was a 
very candid, internal memorandum that was written solely for the Under Secretary’s deliberation. 
We believe it is vital that this kind of confidential, deliberative communication be allowed to 
take place to maintain trust with the authors of such communications and to ensure candid advice 
and opinions that will make for better decision-making in NPPD. NPPD made the correct 
decision to limit the distribution of the internal memorandum. 

The ISCD Action Plan, which was included as an appendix to the internal memorandum, has 
been refined and updated and is widely available to the staff as they are engaged in moving the 
CFATS program forward. 


Personnel Surety 

Question: Just before this Subcommittee began the first part of this hearing on Chemical 
Facility Security in July, NPPD withdrew its information collection request on personnel surety, 
which had become quite controversial, and noted that it planned to re-initiate the process shortly. 
At the Energy and Commerce hearing last week, Mr. Wulf testified that the Transportation 
Worker Identification Credential (TWIC) would be an acceptable means to vet chemical security 
personnel; however this credential had to be electronically verified. At this point, DHS does not 
plan on having approved TWIC readers in place until 2014. What will you do in the interim to 
vet chemical facility personnel if electronic TWIC verification is not possible in the near term? 

ANSWER: When the CFATS Personnel Surety Program is implemented, NPPD anticipates that 
high-risk chemical facilities will have several options from which to choose to comply with the 
portion of RBPS 12 that concerns checking individuals for terrorist ties. For example, NPPD 
expects that if an affected individual is in possession of a TWIC, the high-risk chemical facility 
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will have the opportunity to submit some information about the affected individual so that the 
Department may verify and validate the affected individual’s enrollment in the TWIC Program. 
In addition, the Department is actively considering, and discussing with stakeholders other 
options for effectively leveraging current vetting processes, including the use of existing 
technologies for electronic verification of existing credentials. 

Question: Since pulling the original information collection request, NPPD has held some 
informal discussions with the chemical facility owners and operators on the new personnel surety 
proposal, and indicated to them that they planned to resubmit an ICR by October 1 1' However, 
some of these meetings have now been postponed, leading to questions about the reliability of a 
mid-October date. When do you anticipate the new personnel surety information collection 
request will be available for public comment? While I know you have been working with the 
affected industries, have you also done outreach to the third party enrollers, chemical facilities 
workers, and labor unions prior to this planned release so that the next proposal is not so 
contentious? 

ANSWER: NPPD is seeking to re-initiate the Paperwork Reduction Act process as soon as 
possible by publishing a notice in the Federal Register seeking comments for 60 days. 

As Director Wulf and Deputy Under Secretary Spaulding testified, NPPD started to reach out to 
our industry stakeholders prior to the September hearing about personnel surety. Since the 
hearing, we have continued to meet with leaders and members of the Chemical Sector 
Coordinating Council and the Oil & Namral Gas Sector Coordinating Council, on a variety of 
topics. NPPD also issued invitations to other stakeholders, including third-party enrollers and 
labor unions, and subsequently held meetings and/or conference calls with stakeholders and their 
members to discuss the CFATS Personnel Surety Program and to solicit suggestions on ways to 
improve it. 

Are There Lessons Learned that Could AppIv to the Ammonium Nitrate Regulatory 

Process? 


Question: Ms. Spaulding, one can assume DHS is assessing lessons learned from the 
complicated regulatory challenges and management issues surrounding chemical facility 
security. Is that the case? If so, how do you intend to apply the lessons learned as it implements 
other regulatory frameworks, such as the Ammonium Nitrate program, which has been 
repeatedly delayed and is currently winding through the rule-making process? 

ANSWER: Yes, the Department has been evaluating lessons learned and applying solutions 
where applicable. Lessons learned in both the development of the CFATS rule and the creation 
of an organization to implement CFATS are being incorporated into the development of the 
Ammonium Nitrate rule and implementation plan. Additionally, the Department believes there 
are a number of similarities between the proposed Ammonium Nitrate program and the proposed 
CFATS Personnel Surety Program and intends not only to apply lessons learned from CFATS 
Personnel Surety efforts to the Ammonium Nitrate program, but also to take advantage of 
relationships, processes, information technology, and other aspects of the CFATS Personnel 
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Surety Program to the maximum extent possible for implementing the Ammonium Nitrate 
program. 

Question: Mr. Caldwell, to what extent might the implementation challenges of the CFATS 
program carry over into the development of the Ammonium Nitrate program? 

ANSWER: (Question is directed to Mr. Caldwell of the Government Accountability Office.) 

Are Companies Moving Chemicals Offsite to be Exempt from CFATS Regulations? 

Question: During past hearings, despite the many problems reported, DHS has touted the 
successes associated with DHS efforts to implement the CFATS program. One of these successes 
appears to be related to DHS’s “top-screen”. Over 40,000 top screens were conducted to 
determine which chemical industries were high-risk and subject to vulnerability assessments. In 
doing these top screens, some companies decided to remove chemicals of interest from sites or 
facilities making the facility exempt from the CFATS rule. In testimony before the House 
Subcommittee on Environment and the Economy, Under Secretary Beers reported that about 
2,700 facilities have eliminated, reduced, or otherwise modified their chemical holdings and are 
no longer considered high-risk. This figure is up from the 1,600 facilities NPPD had indicated 
earlier this year that had completely removed their chemical holdings and the facilities were no 
longer considered high-risk. Ms. Spaulding, what processes does DHS have in place to verify 
that these chemicals have been removed, and remain removed? 

ANSWER: Any high-risk facility that has materially altered its operations must submit a revised 
Top-Screen. If a covered facility submits a revised Top-Screen indicating that it has reduced or 
eliminated COI, DHS may request that the facility provide additional information, such as bills 
of lading, management control documents, inventory reports, and shipping and receiving 
documents so that DHS can verify the modifications claimed by the facility. DHS also may 
request that its inspectors be allowed to conduct a CAV to verify that the facility has removed or 
reduced its COI. DHS reviews all available information and then notifies the facility as to 
whether or not its status as high-risk or its risk-based tier will be changed. 

Question: We have heard that some companies may be either moving chemicals of interest to 
other sites or placing them on rail cars or in containers offsite so as to avoid regulation. Has this 
occurred? What action would DHS take if it found that it was occurring? Finally, what 
assurance can you provide this Subcoirunittee that this will not occur in the future? 

ANSWER: Some facilities determined by the Department to be high-risk, as well as some 
facilities that have not yet been determined to be high-risk, have taken various approaches to 
handling their COI including, in some cases, consolidating holdings of COI at a single facility, 
relocating the holding containers offsite, or switching to “just in time” delivery systems. If DHS 
becomes aware (e.g., through a revised Top-Screen) of a modification that has the effect of 
shifting the risk to a facility not regulated under CFATS but potentially subject to another 
regulatory entity (e.g., placing a rail car offsite; relocating the chemical to a portion of the 
facility regulated under the Maritime Transportation Security Act), the Department would 
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contact the appropriate entity (e.g., the Transportation Security Administration; the U.S. Coast 
Guard) or take other appropriate steps as necessary. 


QUESTIONS FOR THE RECORD SUBMITTED BY 

THE HONORABLE John Carter 

Steve Caldwell, Director, Homeland Security & Justice Issues, Government Accountability 

Office (GAO) 

Suzanne Spaulding, Deputy Under Secretary, National Protection and Programs 
Directorate, DHS 

David Wulf, Director, Office of Infrastructure Protection, DHS 

Department of Homeland Security - Chemical Facility Anti-Terrorism Standards (CFATS) 

Program 

September 20, 2012 


Site Security Plan Approval 

Question: DHS has stated it plans to pick up the pace with SSP approvals for Tier I facilities 
and begin Tier 2 authorizations, Does DHS have a specific implementation plan that includes 
specific milestones for each phase of the approval process and for each CFATS Tier Level? 
Please provide to this Committee your implementation timeline and plan, 

ANSWER: Prior to approving an SSP, or an ASP in lieu of an SSP, ISCD must first review and 
then authorize the SSP or ASP, The review process is initiated when ISCD receives the SSP or 
ASP from a covered facility, ISCD then reviews the SSP/ASP to determine preliminarily if it 
satisfies the applicable KBPS under the CFATS regulation, 6 C.F.R. Part 27. This process 
typically involves discussions between ISCD staff and the facility and often requires additional 
information from the facility and revision of the SSP/ASP before ISCD can complete its initial 
review and issue the facility a Letter of Authorization for its SSP/ASP. After issuing a Letter of 
Authorization, ISCD conducts a comprehensive and detailed authorization inspection. The 
inspection results, as well as any further revisions that the facility may make to the SSP/ASP, are 
reviewed to make a final determination as to whether the facility’s SSP/ASP satisfies the 
applicable RBPSs and whether to issue a Letter of Approval. Upon approval, the facility must 
implement the applicable provisions of the SSP/ASP. If ISCD determines that an SSP/ASP does 
not satisfy the applicable RBPS, ISCD may issue a Notice of Deficiency and require the facility 
to resubmit a sufficient SSP/ASP. If the facility fails to do so, ISCD may disapprove the 
SSP/ASP. 

ISCD is scheduled to complete authorization inspections by the fourth quarter of FY 2013 for 
Tier 1 facilities and by the second quarter of FY 2014 tor Tier 2 facilities. Following the 
authorization inspection, facilities generally are granted an additional 45 days to make any 


Page 16 of 21 




122 


necessary modifications to their SSP/ASPs. ISCD then will review the re-submitted SSP/ASP 
and make a final determination on whether the SSP/ASP warrants the issuance of a Letter of 
Approval. In some cases, the facility may require a technical consultation and another 
opportunity to revise its SSP/ASP, Therefore, the schedule to issue Letters of Approval to 
facilities is projected to be the first quarter of FY 2014 for Tier 1 , and by the third quarter of FY 
2014 for Tier 2 facilities. 

The population of Tier 3 and Tier 4 facilities, which pose relatively lower risks than Tier 1 and 
Tier 2 facilities, is much larger and DHS is developing options to effectively evaluate their 
SSPs/ASPs. 

Question: DHS has stated that it is currently not able to fully approve or authorize SSPs until the 
Personnel Surety Program (PSP) has been finalized. Is it true that DHS will only be issuing 
“conditional” authorizations and approvals until the PSP program is in place? If so, does this 
mean that DHS can disapprove an SSP that was previously conditionally approved, once the PSP 
is in place? 

ANSWER: ISCD reviews and approves facility SSPs based on established RBPSs, RBPS-12 
(Personnel Surety) requires covered facilities to implement security measures to identify 
individuals with terrorist ties. DHS is developing a Personnel Surety Program that would 
provide facilities with options to implement such measures. DHS currently is reserving 
judgment on the approval of SSPs with regard to that aspect of RBPS-12. ISCD will work with 
covered facilities to ensure that their SSPs adequately address all applicable aspects of RBPS-12 
as the implementation of the Personnel Surety Program progresses. In the meantime, ISCD is 
moving forward with approvals so that facilities can implement the other security measures 
described in their plans. 


Personnel Surety 

Question; DHS first issued a public notice on the Personnel Surety Program (PSP) in June 2009. 
And recently DHS announced it is now taking a fresh look at the PSP and has withdrawn their 
proposal from OMB, where it sat for 14 months. Now DHS says it will be issuing another 60 day 
notice for public comment before the end of this year and then resubmit a revised final proposal 
to OMB for their review and approval, perhaps by March 2013. 

Given the past history on this issue and the extraordinary time it has taken DHS to develop a PSP 
that appropriately addresses the security of personnel at facilities while minimizing the burden 
on the regulated community, why is DHS proposing such a protracted follow up process to 
address issues that have clearly been articulated by the regulated community and others? 

a. Will DHS provide options for PSP compliance based the unique circumstances of a 
covered facility? Please explain what those options include and how they benefit the 
facility. 
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b. Will DHS continue to insist on duplicative reporting of personal identifying 
information (PII) for those who can present a current and valid TWIC credential for 
compliance to the TSDB requirement? 

c. Recent media reports indicate DHS will accept the use of government issued ID cards 
like the Transportation Workers Identification Credential (TWIC) as compliance with 
the PSP requirement for terrorist database screening, but will continue to require 
regulated sites to submit personal information on those entering the site to DHS, 

Why does DHS need this redundant information? 

d. Does DHS plan on requiring Card Readers at CFATS facilities as part of its new 
evolved thinking on the PSP? Has DHS conducted a cost impact on the regulated 
community to purchase, install, use and maintain card reader software and hardware 
technology and the business impact this will have by restricting the flow of workers 
to and from the facilities? If so, can you please provide that information to the 
committee? 

e. Does DHS believe it has an investigative role when it comes to potential hits on the 
TSDB? If so, please provide to this committee, where that authority resides? 

f. What role does DHS believe it has regarding its implementation and enforcement of 
Risk Based Performance Standard 12 covering PSP? 

ANSWERS: 

a. Will DHS provide options for PSP compliance based on the unique circumstances of a 
covered facility? Please explain what those options include and how they benefit the 
facility. 

ANSWER: Yes. The Department has designed the CFATS Program to allow each 
facility in its SSP or ASP to account for its unique circumstances when considering how 
to comply with RBPS-12(iv), which requires that final high-risk chemical facilities 
implement “measures designed to identify people with terrorist ties.” The ability to 
identify individuals with terrorist ties requires the use of information held in Federal 
Government databases that are unavailable to high-risk chemical facilities. When 
implemented, the CFATS Personnel Surety Program will provide facilities multiple 
options to comply with this regulatory requirement. 

High-risk chemical facilities will have, through their SSPs or ASPs, the ability to address 
RBPS 12(iv). High-risk chemical facilities may restrict the numbers and types of persons 
they allow to access their restricted areas and critical assets, thus limiting the number of 
persons who will need to be vetted for terrorist ties. High-risk chemical facilities also 
have wide latitude in how they define their restricted areas and critical assets in their 
SSPs or ASPs, thus potentially limiting or controlling the number of persons who will 
need to be vetted for terrorist ties. High-risk chemical facilities also may choose to escort 
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visitors to restricted areas and critical assets in lieu of performing the background checks 
required by RBPS 12. 

In addition, high-risk chemical facilities will be able to ( 1 ) choose one or more options 
for terrorist ties vetting or vetting verification that the Department has described to date 
or may make available in the ftiture, or (2) propose a different alternative altogether that 
works best for Iheir circumstances, 

b. Will DHS continue to insist on duplicative reporting of personal identifying information 
(PII) for those who can present a current and valid TWIC credential for compliance to the 
TSDB requirement? 

ANSWER: The Department supports the sharing and reuse of vetting results among 
different screening programs and is actively considering, and discussing with 
stakeholders, options for effectively leveraging vetting already done on individuals with a 
current and valid TWIC. 

c. Recent media reports indicate DHS will accept the use of government issued ID cards 
like the Transportation Workers Identification Credential (TWIC) as compliance with the 
PSP requirement for terrori.st database screening, but will continue to require regulated 
sites to submit personal information on those entering tlie site to DHS. Why does DHS 
need this redundant infonnation? 

ANSWER: The Department supports the sharing and reuse of vetting results among 
different screening programs and is actively considering, and discussing with 
stakeholders, options for effectively leveraging vetting already done on individuals with 
current and valid credentials. 

d. Does DHS plan on requiring Card Readers at CFATS facilities as part of its new evolved 
thinking on the PSP? Has DHS conducted a cost impact on the regulated community to 
purchase, install, use and maintain card reader software and hardware technology and the 
business impact this will have by restricting the flow of workers to and from the 
facilities? If so, can you please provide that information to the committee? 

ANSWER: No, DHS is not contemplating requiring electronic card readers at CFATS 
facilities as part of the CFATS Personnel Surety Program. Facilities will have a variety 
of options for complying with RBPS 12(iv) as part of their SSPs or ASPs. DHS is 
considering the cost to fecilities of purchasing and using card readers if they choose this 
option, but those estimates are still under review, 

e. Does DHS believe it has an investigative role when it comes to potential hits on the 
TSDB? If so, please provide to this committee, where that authority resides? 

ANSWER: No; however, DHS will coordinate with Federal law enforcement entities as 
appropriate to monitor and/or prevent any situations in which known or suspected 
terrorists seek access to high-risk chemical facilities. 
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f. What role does DHS believe it has regarding its implementation and enforcement of Risk 
Based Performance Standard 12 covering PSP? 

ANSWER: DHS has the responsibility to inspect and audit whether or not a covered 
facility has implemented the security measures contained in an approved SSP related to 
RBPS 12. 

Question: While DHS is focusing on the highest risk facilities first, the bulk of the facilities in 
the CFATS program are in the lower risk tiers. Going at the current pace, it will be many years 
before DHS will begin approving lower risk facilities. 

Has DHS considered a multi-pronged approach that addresses the CFATS risk spectrum from 
both ends? Has DHS considered the application of its ASP authority for review and approval of 
lower risk facilities in a way that will streamline the implementation process? Has DHS looked 
at other examples/models such as the Coast Guard’s Alternative Security Program (ASP) as a 
best practice to help improve the pace of SSP approvals? 

ANSWER: Over the past few months, DHS has taken numerous steps to make its procedures 
more efficient and to increase the pace at which facilities’ SSPs are evaluated. These include 
streamlining the SSP review process itself, working on improvements to both the data collection 
and plan review tools, and getting the Department’s field staff involved earlier in the process to 
help identify and work with facilities whose SSPs require additional information before they can 
be fully evaluated. Additionally, the Department is currently exploring various approaches to 
address lower-tiered facilities in an even more efficient manner. This includes working with 
industry on ASPs, reengaging the U.S, Coast Guard on its approach to ASPs to see if there are 
additional best practices or lessons learned that could be incorporated into CFATS, and 
identifying ways to make ASPs a more effective option that could be used to a greater extent by 
lower-tier high-risk facilities. 


Alternative Security Plans 

Question: In your recent testimony at the House Appropriations Hearing, DHS stated that it 
continues to review existing industry programs, such as ACC Re.sponsible Care® and SOCMA 
ChemStewards®, to identify potential areas of engagement and further discussion. While DHS 
has struggled to move the CFATS program forward, the chemical industry has made significant 
progress on their own through continuous improvement programs like Responsible Care. It 
seems that a smart regulatory approach would be able to leverage existing programs to help 
improve chemical security and advance CFATS implementation. Have you made any progress in 
this area? If so, please elaborate? 

ANSWER: Many members of the regulated community and their representative industry 
associations have expressed interest in exploring ways to use the ASP provisions of the CFATS 
regulation to streamline the security plan submission and review process. ISCD shares this goal 
and has been holding discussions with industry stakeholders in regard to their development of 
ASP templates on behalf of their members. One example has been ISCD’s engagement with the 
American Chemistry Council (ACC) in regard to its efforts to develop an ASP template for use 
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by interested members of its organization. The ACC developed a template which was piloted at 
facilities in early August and late October, ACC has indicated that it expects its ASP template to 
be available for wider use later this year. In addition, DHS has been in discussions with other 
industry stakeholders and associations about developing templates specific to their members and 
sub-sectors. ASPs submitted by facilities using industry-established models, such as the ACC 
template, will be reviewed under the same standards that ISCD currently reviews SSPs, but the 
use of ASP templates should streamline both the plan development and plan review processes. 
Additionally, DHS continues to review existing industry, and sector-specific programs, such as 
ACC Responsible Care® and SOCMA ChemStewards®, to identify potential areas of 
engagement that may contribute to CFATS implementation. 
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Enclosure 


QUESTIONS FOR THE RECORD SUBMITTED BY 

THE HONORABLE David Price 

Steve Caldwell, Director, Homeland Security & Justice Issues, Government 
Accountability Office (GAO) 

Department of Homeland Security - Chemical Facility Anti-Terrorism Standards 

(CFATS) Program 

September 20, 2012 


Internal Mismanagement Issues 

Question: Mr. Caldwell, what is GAO’s assessment of how adequately 
National Protection and Programs Directorate (NPPD) is addressing the items 
of concern from this internal memorandum? 

DHS’ Infrastructure Security Compiiance Division (iSCD) — a division of the Office of 
Infrastructure Protection (IP) within NPPD — appears to be headed in the right 
direction in addressing the challenges described in the internal memorandum.^ 
However, it is too early to tell if the corrective actions are adequate because ISCD is 
in the early stages of implementing them and has not yet established performance 
measures to assess results. According to ISCD officials, almost half of the action 
items included in the June 2012 action plan either required ISCD to collaborate with 
NPPD and IP or required NPPD and IP to take action to address the challenges 
identified in the ISCD memorandum. NPPD, IP, and ISCD officials have been 
working together to identify solutions to the challenges the memorandum identified 
and to implement pertinent action items. For example in response to one action item, 
ISCD, NPPD, and IP had begun meeting weekly and on a recurring basis to discuss 
hiring and other human capital issues. For another action item, ISCD and NPPD 
Office of Employee and Labor Relations officials are meeting weekly to discuss 
union-related issues including how the union operates and how management should 
work with and properly address the division's obligations to the union. 

Nonetheless, we concluded that ISCD, working with NPPD and IP, may be better 
positioned to understand and report on the adequacy of addressing items in the 
action plan by looking for opportunities to measure the effect of efforts to implement 
key action items. We recommended that DHS look for opportunities, where 
practical, to measure its performance implementing actions items. OHS agreed with 
our recommendation and has since added an action item to its action plan to 
develop measures. By developing performance measures, where practical, NPPD, 
IP, and ISCD would be better equipped to identify any gaps in the adequacy of the 
actual and planned or expected results and take corrective action. 


^ GAO. Critical Infrastructure Protection: DHS is taking Action to Better Manage its Chemical Security Program, 
but It Is Too Early to Assess Results, GA012-515T {Washington, D.C.: Ju). 26, 2012) and GAO, Critical 
In^astructure Protection: Summary of DHS Actions to Better Manage Its Chemical Security FTogram, GAO- 
121044T (Washington, D.C.: Sept. 20. 2012). 
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Question; Mr. Caldwelf, since not ail of the action items are specifically 
segregated to the Infrastructure Security Compliance Division (ISCD) or even 
NPPD, who else needs to be involved to implement and close these action 
items? DHS Acquisition? DHS Office of the Chief Human Capital Officer? Are 
these other DHS entities working weii with NPPD and taking the necessary 
steps to ensure we don’t see misuse of funds or hiring practices in the future? 

The scope of our work was limited to NPPD, IP, and ISCD and we did not review the 
extent to which corrective actions required coordination with DHS-level 
organizations. At the time of our work, we found that NPPD, IP, and ISCD were 
working together to identify solutions to the challenges the memorandum identified 
and to close pertinent action items. 

Are There Lessons Learned that Could AddIv to the Ammonium Nitrate 
Regulatory Process 


Question: Mr. Caldwell, to what extent might the implementation challenges of 
the CFATS program carry over into the development of the Ammonium Nitrate 
program? 

DHS’s Ammonium Nitrate rule has not been finalized, so it is difficult to determine 
the extent to which the challenges implementing the CFATS program might carry 
over into the development of the Ammonium Nitrate program. Nonetheless, given 
that both the Ammonium Nitrate program and CFATS program reside in ISCD, an 
examination of how it plans to implement and manage both programs could benefit 
ISCD. For example in our view, such a review could include a review of lessons 
learned arising out of the problems ISCD encountered establishing CFATS so that it 
can avoid some of the same pitfalls and challenges when implementing the 
Ammonium Nitrate program. 
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